TLS SNI support for OpenSSL ($tls_sni)

[exim.git] / doc / doc-txt / NewStuff

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index c25e51ba073c6af922ea133f0df589b39290960e..b788b45dc47f029bb903dc8825ef113ad7f1dd10 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -13,10 +13,7 @@ Version 4.78
     This is a SASL interface, licensed under GPL, which can be found at
     http://www.gnu.org/software/gsasl/.
     This system does not provide sources of data for authentication, so
     This is a SASL interface, licensed under GPL, which can be found at
     http://www.gnu.org/software/gsasl/.
     This system does not provide sources of data for authentication, so

-    careful use needs to be made of the conditions in Exim.  Note that
-    this can not yet be used as a drop-in replacement for Cyrus SASL, as
-    Exim is currently unable to construct strings with embedded NULs for
-    use as keys in lookups against sasldb2.
+    careful use needs to be made of the conditions in Exim.

 
  2. New authenticator driver, "heimdal_gssapi".  Server-only.
     A replacement for using cyrus_sasl with Heimdal, now that $KRB5_KTNAME
 
  2. New authenticator driver, "heimdal_gssapi".  Server-only.
     A replacement for using cyrus_sasl with Heimdal, now that $KRB5_KTNAME


@@ -33,7 +30,24 @@ Version 4.78
 
  5. New lookup type, "dbmjz".  Key is an Exim list, the elements of which will
     be joined together with ASCII NUL characters to construct the key to pass
 
  5. New lookup type, "dbmjz".  Key is an Exim list, the elements of which will
     be joined together with ASCII NUL characters to construct the key to pass

-    into the DBM library.
+    into the DBM library.  Can be used with gsasl to access sasldb2 files as
+    used by Cyrus SASL.
+
+ 6. OpenSSL now supports TLS1.1 and TLS1.2 with OpenSSL 1.0.1.
+
+    Avoid release 1.0.1a if you can.  Note that the default value of
+    "openssl_options" is no longer "+dont_insert_empty_fragments", as that
+    increased susceptibility to attack.  This may still have interoperability
+    implications for very old clients (see version 4.31 change 37) but
+    administrators can choose to make the trade-off themselves and restore
+    compatibility at the cost of session security.
+
+ 7. Use of the new expansion variable $tls_sni in the main configuration option
+    tls_certificate will cause Exim to re-expand the option, if the client
+    sends the TLS Server Name Indication extension, to permit choosing a
+    different certificate; tls_privatekey will also be re-expanded.  You must
+    still set these options to expand to valid files when $tls_sni is not set.
+    Currently OpenSSL only.

 
 
 Version 4.77
 
 
 Version 4.77