# TLS server: general ops and certificate extractions
#
-# NOTE: current OpenSSL libraries return faulty my-cert information
-# when more than one is loaded, which the conf for this testcase does.
+# NOTE: OpenSSL libraries return faulty my-cert information prior to OpenSSL 1.1.1
+# when more than one cert is loaded, which the conf for this testcase does.
# As a result the expansion done and logged is misleading.
+# While the golden log output is set to the misleading result, the testcase
+# would unfortunately fail on the fixed OpenSSL versions. This has been bodged
+# by the addition of log/2102.openssl_1_1_1 and some detection coding in
+# runtest to force a "flavour". This is fragile and bound to break in the future.
#
# Make RSA authentication the only acceptable
exim -DSERVER=server -DORDER=RSA -bd -oX PORT_D
??? 250
starttls
??? 220
-mail from:<CALLER@test.ex>
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+mail from:<a@test.ex>
??? 250
rcpt to:<CALLER@test.ex>
??? 250
??? 250
starttls
??? 220
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
mail from:<"name with spaces"@test.ex>
??? 250
rcpt to:<CALLER@test.ex>
??? 250
starttls
??? 220
-mail from:<CALLER@test.ex>
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+mail from:<b@test.ex>
??? 250
rcpt to:<CALLER@test.ex>
??? 250
#
# make ECDSA authentication preferred
# DEFAULT:+RSA should work but does not seem to
+# also, will fail under TLS1.3 because there is no choice of auth
+# - so we disable that in the conf
exim -DSERVER=server -DORDER=ECDSA:RSA:!COMPLEMENTOFDEFAULT -bd -oX PORT_D
****
client-ssl 127.0.0.1 PORT_D
??? 250
starttls
??? 220
-mail from:<CALLER@test.ex>
+ehlo rhu.barb
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+mail from:<c@test.ex>
??? 250
rcpt to:<CALLER@test.ex>
??? 250