acl_smtp_rcpt = accept verify = recipient/callout
.endif
-log_selector = +received_recipients +tls_peerdn +tls_certificate_verified
+log_selector = +received_recipients +tls_peerdn +tls_certificate_verified \
+ +tls_sni
queue_run_in_order
tls_advertise_hosts = *
-# Set certificate only if server
CDIR1 = DIR/aux-fixed/exim-ca/example.net/server1.example.net
CDIR2 = DIR/aux-fixed/exim-ca/example.com/server1.example.com
.ifdef CERT
tls_certificate = CERT
.else
-tls_certificate = ${if eq {SERVER}{server} \
- {${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
+tls_certificate = ${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
{CDIR2/fullchain.pem}\
- {CDIR1/fullchain.pem}}}\
- fail}
+ {CDIR1/fullchain.pem}}
.endif
.ifdef ALLOW
tls_privatekey = ALLOW
.else
-tls_privatekey = ${if eq {SERVER}{server} \
- {${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
+tls_privatekey = ${if or {{eq {DETAILS}{ta}} {eq {DETAILS}{ca}} {eq {DETAILS}{ee}}} \
{CDIR2/server1.example.com.unlocked.key}\
- {CDIR1/server1.example.net.unlocked.key}}}\
- fail}
+ {CDIR1/server1.example.net.unlocked.key}}
.endif
# ----- Routers -----
driver = smtp
allow_localhost
port = PORT_D
+ hosts_try_fastopen = :
hosts_try_dane = CONTROL
hosts_require_dane = HOSTIPV4