OpenSSL: better handling of $tls_{in,out}_certificate_verified under resumption

[exim.git] / doc / doc-txt / experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index f5f72f551a0bac374668089b52ad28b32b53d88c..aa7046e58f9b8bb1398eb1795f7a44d0b62cf134 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -993,19 +993,18 @@ Observability:
  New log_selector "tls_resumption", appends an asterisk to the tls_cipher "X="
  element.
 
- Variables $tls_{in,out}_resumption have bit 0-4 indicating respectively
+ Variables $tls_{in,out}_resumption have bits 0-4 indicating respectively
  support built, client requested ticket, client offered session,
  server issued ticket, resume used.  A suitable decode list is provided
  in the builtin macro _RESUME_DECODE for ${listextract {}{}}.
 
 Issues:
  In a resumed session:
-  $tls_{in,out}_{certificate_verified,{peer,our}cert} will be unset
-  verify = certificate will be false
-  $tls_{in,out}_cipher will have values different to the original
-  $tls_{in,out}_bits (is unspecified)
-  $tls_{in,out}_ocsp will be "not requested"
-  $tls_{in,out}_peerdn will be unset
+  $tls_{in,out}_certificate_verified will be set, and verify = certificate
+    will be true, when verify failed but tls_try_verify_hosts allowed the
+    connection (under OpenSSL)
+  $tls_{in,out}_cipher will have values different to the original (under GnuTLS)
+  $tls_{in,out}_ocsp will be "not requested" or "no response"
 
 
 --------------------------------------------------------------