<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
Hi Andreas,<br>
I have this as my config.<br>
<br>
tls_certificate = /etc/exim4/mail.fsck.tv-cert.pem<br>
tls_privatekey = /etc/exim4/mail.fsck.tv-key.pem<br>
log_selector = +tls_peerdn<br>
tls_dhparam = /etc/exim4/dh.key<br>
tls_advertise_hosts = *<br>
#auth_advertise_hosts = ${if eq {$tls_cipher}{}{}{*}}<br>
auth_advertise_hosts = *<br>
tls_try_verify_hosts = *<br>
tls_verify_certificates = /etc/exim4/cacerts/cacert.pem <u><- (yes
this is a file and not a directory)</u><br>
<br>
The point I was trying to make is that exim doesn't send a certificate
when asked<br>
even if you have the following:<br>
<br>
remote_smtp:<br>
driver = smtp<br>
tls_certificate = /etc/exim4/mail.fsck.tv-cert.pem<br>
tls_privatekey = /etc/exim4/mail.fsck.tv-key.pem<br>
<br>
recompile both servers against openssl and it magicly works, but only
if both are build against openssl.<br>
<br>
<br>
Regards<br>
Jon<br>
<br>
<br>
<br>
On 01/08/10 17:35, Andreas Metzler wrote:
<blockquote cite="mid:20100801163542.GC3345@downhill.g.la" type="cite">
<pre wrap="">On 2010-08-01 Jon Westgate <a class="moz-txt-link-rfc2396E" href="mailto:oryn@fsck.tv"><oryn@fsck.tv></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Package: exim4
Version: 4.72-1
Severity: important
Tags: upstream
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I have been asked to setup an exim4 server for use with CJSM.
<a class="moz-txt-link-freetext" href="https://www.cjsm.net">https://www.cjsm.net</a> This requires that a server (acting as a smart
host in this case) encrypt and sign all emails headed for CJSM.
This is something that according to exim.org, exim should ba
capeable of doing. After struggling with this for a number of days
I came accross a blog entry on the web saying that exim compiled
against openssl seemed to work where as exim compiled against gnutls
didn't. I recompiled and hey presto everything works. I'm not
campaining for openssl to be the default in exim, just mearly
registering the fact that both tls_try_verify_hosts and
tls_verify_hosts directives fail with this package. Indeed exim as
a client does not send a certificate when asked for one.
</pre>
</blockquote>
<pre wrap="">[...]
Hello,
the information you provided is sparse. I was to ask for a guess I would think that stumpled upon
| 39.2 OpenSSL vs GnuTLS
|
| The tls_verify_certificates option must contain the name of a file,
| not the name of a directory (for OpenSSL it can be either).
cu andreas
</pre>
</blockquote>
<br>
</body>
</html>