Support OCSP Stapling under GnuTLS. Bug 1459
[users/jgh/exim.git] / test / confs / 5651
1 # Exim test configuration 5651
2 # OCSP stapling, client
3
4 SERVER =
5
6 exim_path = EXIM_PATH
7 host_lookup_order = bydns
8 primary_hostname = server1.example.com
9 rfc1413_query_timeout = 0s
10 spool_directory = DIR/spool
11 log_file_path = DIR/spool/log/SERVER%slog
12 gecos_pattern = ""
13 gecos_name = CALLER_NAME
14
15
16 # ----- Main settings -----
17
18 domainlist local_domains = test.ex : *.test.ex
19
20 acl_smtp_rcpt = check_recipient
21 log_selector = +tls_peerdn
22 remote_max_parallel = 1
23
24 tls_advertise_hosts = *
25
26 # Set certificate only if server
27 tls_certificate = ${if eq {SERVER}{server}\
28 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.chain.pem}\
29 fail\
30 }
31 tls_privatekey = ${if eq {SERVER}{server}\
32 {DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key}\
33 fail}
34
35 # from cmdline define
36 tls_ocsp_file = OCSP
37
38
39 # ------ ACL ------
40
41 begin acl
42
43 check_recipient:
44   accept  domains = +local_domains
45   deny    message = relay not permitted
46
47
48 # ----- Routers -----
49
50 begin routers
51
52 client:
53   driver = accept
54   condition = ${if eq {SERVER}{server}{no}{yes}}
55   retry_use_local_part
56   transport = send_to_server${if eq{$local_part}{nostaple}{1} \
57                                 {${if eq{$local_part}{smtps} {3}{2}}} \
58                              }
59
60 server:
61   driver = redirect
62   data = :blackhole:
63   #retry_use_local_part
64   #transport = local_delivery
65
66
67 # ----- Transports -----
68
69 begin transports
70
71 local_delivery:
72   driver = appendfile
73   file = DIR/test-mail/$local_part
74   headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
75   user = CALLER
76
77 send_to_server1:
78   driver = smtp
79   allow_localhost
80   hosts = HOSTIPV4
81   port = PORT_D
82   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
83   hosts_require_tls = *
84 # note no ocsp here
85
86 send_to_server2:
87   driver = smtp
88   allow_localhost
89   hosts = 127.0.0.1
90   port = PORT_D
91   helo_data = helo.data.changed
92   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
93   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
94   hosts_require_tls =  *
95   hosts_require_ocsp = *
96
97 send_to_server3:
98   driver = smtp
99   allow_localhost
100   hosts = 127.0.0.1
101   port = PORT_D
102   helo_data = helo.data.changed
103   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
104   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
105   protocol =           smtps
106   hosts_require_tls =  *
107   hosts_require_ocsp = *
108
109
110 # ----- Retry -----
111
112
113 begin retry
114
115 * * F,5d,1s
116
117
118 # End