1 # Exim test configuration 2033
2 # TLS client: verify certificate from server - name-fails
7 host_lookup_order = bydns
8 primary_hostname = myhost.test.ex
9 spool_directory = DIR/spool
10 log_file_path = DIR/spool/log/SERVER%slog
12 gecos_name = CALLER_NAME
15 S1 = FX/exim-ca/example.com/server1.example.com
18 CERT1 = S1/server1.example.com.pem
19 KEY1 = S1/server1.example.com.unlocked.key
24 # ----- Main settings -----
26 acl_smtp_rcpt = accept
28 log_selector = +tls_peerdn+tls_certificate_verified
33 tls_advertise_hosts = *
35 # Set certificate only if server
37 tls_certificate = ${if eq {SERVER}{server}{CERT1}fail}
38 tls_privatekey = ${if eq {SERVER}{server}{KEY1}fail}
41 tls_verify_certificates = ${if eq {SERVER}{server}{CERT2}fail}
50 condition = ${if eq {SERVER}{server}{yes}{no}}
57 transport = send_to_server_failcert
64 transport = send_to_server_retry
70 transport = send_to_server_crypt
76 transport = send_to_server_req_fail
82 transport = send_to_server_req_failname
88 transport = send_to_server_req_passname
94 transport = send_to_server_req_failcarryon
96 # ----- Transports -----
100 # this will fail to verify the cert at HOSTIPV4 so fail the crypt requirement
101 send_to_server_failcert:
105 hosts_require_tls = HOSTIPV4
107 tls_certificate = CERT2
108 tls_privatekey = CERT2
110 tls_verify_certificates = CA2
112 # this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok
113 send_to_server_retry:
116 hosts = HOSTIPV4 : 127.0.0.1
117 hosts_require_tls = HOSTIPV4
119 tls_certificate = CERT2
120 tls_privatekey = CERT2
122 tls_verify_certificates = \
123 ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}
125 # this will fail to verify the cert but continue unverified though crypted
126 send_to_server_crypt:
130 hosts_require_tls = HOSTIPV4
132 tls_certificate = CERT2
133 tls_privatekey = CERT2
135 tls_verify_certificates = CA2
136 tls_try_verify_hosts = *
138 # this will fail to verify the cert at HOSTNAME and fallback to unencrypted
139 # Fail due to lack of correct CA
140 send_to_server_req_fail:
145 tls_certificate = CERT2
146 tls_privatekey = CERT2
148 tls_verify_certificates = CA2
151 # this will fail to verify the cert name and fallback to unencrypted
152 # fail because the cert is "server1.example.com" and the test system is something else
153 send_to_server_req_failname:
158 tls_certificate = CERT2
159 tls_privatekey = CERT2
161 tls_verify_certificates = CA1
162 tls_verify_cert_hostnames = *
165 # this will pass the cert verify including name check
166 # our stunt DNS has an A record for server1.example.com -> HOSTIPV4
167 send_to_server_req_passname:
170 hosts = server1.example.com
172 tls_certificate = CERT2
173 tls_privatekey = CERT2
175 tls_verify_certificates = CA1
176 tls_verify_cert_hostnames = *
179 # this will fail to verify the cert name but carry on (try-verify mode)
180 # fail because the cert is "server1.example.com" and the test system is something else
181 send_to_server_req_failcarryon:
186 tls_certificate = CERT2
187 tls_privatekey = CERT2
189 tls_verify_certificates = CA1
190 tls_verify_cert_hostnames = *
191 tls_try_verify_hosts = *