TLS: Feature macros

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index da9d616aecc5a98960298b20d5ecd794a059cfdf..1133ddf18f813f3e8eab9a423b682175b6e05363 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -1886,11 +1886,10 @@ to your &_Local/Makefile_& and rebuild Exim.
 .section "Including TLS/SSL encryption support" "SECTinctlsssl"
 .cindex "TLS" "including support for TLS"
 .cindex "encryption" "including support for"
-.cindex "SUPPORT_TLS"
 .cindex "OpenSSL" "building Exim with"
 .cindex "GnuTLS" "building Exim with"
-Exim can be built to support encrypted SMTP connections, using the STARTTLS
-command as per RFC 2487. It can also support legacy clients that expect to
+Exim is usually built to support encrypted SMTP connections, using the STARTTLS
+command as per RFC 2487. It can also support clients that expect to
 start a TLS session immediately on connection to a non-standard port (see the
 &%tls_on_connect_ports%& runtime option and the &%-tls-on-connect%& command
 line option).
@@ -1899,35 +1898,41 @@ If you want to build Exim with TLS support, you must first install either the
 OpenSSL or GnuTLS library. There is no cryptographic code in Exim itself for
 implementing SSL.
 
+.new
+If you do not want TLS support you should set
+.code
+DISABLE_TLS=yes
+.endd
+in &_Local/Makefile_&.
+.wen
+
 If OpenSSL is installed, you should set
 .code
-SUPPORT_TLS=yes
+USE_OPENSL=yes
 TLS_LIBS=-lssl -lcrypto
 .endd
 in &_Local/Makefile_&. You may also need to specify the locations of the
 OpenSSL library and include files. For example:
 .code
-SUPPORT_TLS=yes
+USE_OPENSL=yes
 TLS_LIBS=-L/usr/local/openssl/lib -lssl -lcrypto
 TLS_INCLUDE=-I/usr/local/openssl/include/
 .endd
 .cindex "pkg-config" "OpenSSL"
 If you have &'pkg-config'& available, then instead you can just use:
 .code
-SUPPORT_TLS=yes
+USE_OPENSL=yes
 USE_OPENSSL_PC=openssl
 .endd
 .cindex "USE_GNUTLS"
 If GnuTLS is installed, you should set
 .code
-SUPPORT_TLS=yes
 USE_GNUTLS=yes
 TLS_LIBS=-lgnutls -ltasn1 -lgcrypt
 .endd
 in &_Local/Makefile_&, and again you may need to specify the locations of the
 library and include files. For example:
 .code
-SUPPORT_TLS=yes
 USE_GNUTLS=yes
 TLS_LIBS=-L/usr/gnu/lib -lgnutls -ltasn1 -lgcrypt
 TLS_INCLUDE=-I/usr/gnu/include
@@ -1935,7 +1940,6 @@ TLS_INCLUDE=-I/usr/gnu/include
 .cindex "pkg-config" "GnuTLS"
 If you have &'pkg-config'& available, then instead you can just use:
 .code
-SUPPORT_TLS=yes
 USE_GNUTLS=yes
 USE_GNUTLS_PC=gnutls
 .endd
@@ -6262,9 +6266,6 @@ Two remote transports and four local transports are defined.
 remote_smtp:
   driver = smtp
   message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}}
-.ifdef _HAVE_DANE
-  hosts_try_dane = *
-.endif
 .ifdef _HAVE_PRDR
   hosts_try_prdr = *
 .endif
@@ -13353,6 +13354,9 @@ or a &%def%& condition.
 &*Note*&: Under versions of OpenSSL preceding 1.1.1,
 when a list of more than one
 file is used for &%tls_certificate%&, this variable is not reliable.
+.new
+The macro "_TLS_BAD_MULTICERT_IN_OURCERT" will be defined for those versions.
+.wen
 
 .vitem &$tls_in_peercert$&
 .vindex "&$tls_in_peercert$&"
@@ -17685,9 +17689,9 @@ separator in the usual way (&<<SECTlistsepchange>>&) to avoid confusion under IP
 &*Note*&: Under versions of OpenSSL preceding 1.1.1,
 when a list of more than one
 file is used, the &$tls_in_ourcert$& variable is unreliable.
-
-&*Note*&: OCSP stapling is not usable under OpenSSL
-when a list of more than one file is used.
+.new
+The macro "_TLS_BAD_MULTICERT_IN_OURCERT" will be defined for those versions.
+.wen
 
 If the option contains &$tls_out_sni$& and Exim is built against OpenSSL, then
 if the OpenSSL build supports TLS extensions and the TLS client sends the
@@ -17840,6 +17844,9 @@ status proof for the server's certificate, as obtained from the
 Certificate Authority.
 
 Usable for GnuTLS 3.4.4 or 3.3.17 or OpenSSL 1.1.0 (or later).
+.new
+The macro "_HAVE_TLS_OCSP" will be defined for those versions.
+.wen
 
 .new
 For OpenSSL 1.1.0 or later, and
@@ -17847,6 +17854,9 @@ For OpenSSL 1.1.0 or later, and
 for GnuTLS 3.5.6 or later the expanded value of this option can be a list
 of files, to match a list given for the &%tls_certificate%& option.
 The ordering of the two lists must match.
+.new
+The macro "_HAVE_TLS_OCSP_LIST" will be defined for those versions.
+.wen
 
 .new
 The file(s) should be in DER format,
@@ -28035,11 +28045,8 @@ to use GnuTLS, you need to set
 .code
 USE_GNUTLS=yes
 .endd
-in Local/Makefile, in addition to
-.code
-SUPPORT_TLS=yes
-.endd
-You must also set TLS_LIBS and TLS_INCLUDE appropriately, so that the
+in Local/Makefile
+you must also set TLS_LIBS and TLS_INCLUDE appropriately, so that the
 include files and libraries for GnuTLS can be found.
 
 There are some differences in usage when using GnuTLS instead of OpenSSL: