TLS: use RFC 6125 rules for certifucate name checks when CNAMES are present. Bug...

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index e5a3c4be80d340bed640e382d4a245ea8efc37d8..e3684ba308ed8060b4192bd6ccf36ba878a02fe5 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -9472,7 +9472,7 @@ Common ways of obtaining untainted equivalents of variables with
 tainted values
 .cindex "tainted data" "de-tainting"
 come down to using the tainted value as a lookup key in a trusted database.
-This database could be the filestem structure,
+This database could be the filesystem structure,
 or the password file,
 or accessed via a DBMS.
 Specific methods are indexed under &"de-tainting"&.
@@ -10201,7 +10201,7 @@ in a list using the given separator.
 .wen
 
 
-.vitem "&*${lookup{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
+.vitem "&*${lookup&~{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
         {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&" &&&
        "&*${lookup&~*&<&'search&~type'&>&*&~{*&<&'query'&>&*}&~&&&
         {*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"
@@ -12473,7 +12473,7 @@ the complete argument of the ETRN command (see section &<<SECTETRN>>&).
 .cindex "tainted data"
 If the origin of the data is an incoming message,
 the result of expanding this variable is tainted.
-When un untainted version is needed, one should be obtained from
+When in untainted version is needed, one should be obtained from
 looking up the value in a local (therefore trusted) database.
 Often &$domain_data$& is usable in this role.
 
@@ -29242,8 +29242,14 @@ certificate verification to the listed servers.  Verification either must
 or need not succeed respectively.
 
 The &%tls_verify_cert_hostnames%& option lists hosts for which additional
-checks are made: that the host name (the one in the DNS A record)
-is valid for the certificate.
+name checks are made on the server certificate.
+.new
+The match against this list is, as per other Exim usage, the
+IP for the host.  That is most closely associated with the
+name on the DNS A (or AAAA) record for the host.
+However, the name that needs to be in the certificate
+is the one at the head of any CNAME chain leading to the A record.
+.wen
 The option defaults to always checking.
 
 The &(smtp)& transport has two OCSP-related options: