1 # Exim test configuration 5892
6 .include DIR/aux-var/tls_conf_prefix
8 primary_hostname = myhost.test.ex
10 # ----- Main settings -----
12 domainlist local_domains = test.ex : *.test.ex
14 acl_smtp_helo = check_helo
15 acl_smtp_rcpt = check_recipient
16 log_selector = +received_recipients +tls_resumption +tls_peerdn +outgoing_port
18 .ifdef _OPT_OPENSSL_NO_TLSV1_3_X
19 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use OPTION
21 openssl_options = +no_sslv2 +no_sslv3 +single_dh_use
23 tls_advertise_hosts = *
24 tls_on_connect_ports = PORT_D2
26 # Set certificate only if server
28 CDIR=DIR/aux-fixed/exim-ca/example.com
30 tls_certificate = CDIR/server1.example.com/server1.example.com.chain.pem
31 tls_privatekey = CDIR/server1.example.com/server1.example.com.unlocked.key
33 tls_resumption_hosts = 127.0.0.1
34 remote_max_parallel = 1
42 accept condition = ${if def:tls_in_cipher}
43 logwrite = tls_in_ver\t$tls_in_ver
44 logwrite = tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
45 logwrite = our cert subject\t${certextract {subject}{$tls_in_ourcert}}
46 logwrite = peer cert subject\t${certextract {subject}{$tls_in_peercert}}
47 logwrite = peer cert verified\t${tls_in_certificate_verified}
48 logwrite = peer dn\t${tls_in_peerdn}
49 logwrite = cipher\t${tls_in_cipher}
50 logwrite = bits\t${tls_in_bits}
54 accept domains = +local_domains
55 deny message = relay not permitted
58 accept condition = ${if def:tls_out_cipher}
59 condition = ${if eq {$event_name}{tcp:close}}
60 logwrite = tls_out_ver\t$tls_out_ver
61 logwrite = tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
62 logwrite = our cert subject\t${certextract {subject}{$tls_out_ourcert}}
63 logwrite = peer cert subject\t${certextract {subject}{$tls_out_peercert}}
64 logwrite = peer cert verified\t${tls_out_certificate_verified}
65 logwrite = peer dn\t${tls_out_peerdn}
66 logwrite = cipher\t${tls_out_cipher}
67 logwrite = bits\t${tls_out_bits}
76 condition = ${if eq {SERVER}{server}{no}{yes}}
77 transport = send_to_server${if eq{$local_part}{hostnotresume}{2}{1}}
83 # ----- Transports -----
94 # Use HELO purely to get a P= different on the server <= line
99 helo_data = helo.data.changed
101 host_name_extract = HELO_MSG
104 tls_resumption_hosts = *
106 tls_resumption_hosts = :
108 tls_verify_certificates = CDIR/CA/CA.pem
109 tls_verify_cert_hostnames = ${if match {$local_part}{^noverify} {*}{:}}
110 tls_try_verify_hosts = *
112 event_action = ${acl {log_resumption}}
120 hosts_try_fastopen = :
121 tls_verify_certificates = CDIR/CA/CA.pem
122 tls_verify_cert_hostnames = :
124 event_action = ${acl {log_resumption}}