Do not permit multi-component wildcards on certificate names (OpenSSL, EXPERIMENTAL_C...

diff --cc doc/doc-txt/ChangeLog
index 5a298d161604b0db07acd6607946e99a9c176b94,b389a7deb6353b023b06dd24074fd4b8ebf14710..997a459c80fa35adbce2f5f6550299b0af5ba4c5
--- 1/doc/doc-txt/ChangeLog
--- 2/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@@ -59,9 -59,11 +59,14 @@@ JH/08 Rename the TPDA expermimental fac
        raised for inbound connections, if the main configuration event_action
        option is defined.
  
 +TL/06 In test suite, disable OCSP for old versions of openssl which contained
 +      early OCSP support, but no stapling (appears to be less than 1.0.0).
 +
+ JH/09 When compiled with OpenSSL and EXPERIMENTAL_CERTNAMES, the checks on
+       server certificate names available under the smtp transport option
+       "tls_verify_cert_hostname" now do not permit multi-component wildcard
+       matches.
+ 
  
  Exim version 4.84
  -----------------

diff --cc doc/doc-txt/experimental-spec.txt
index faa64df68685d133acf8e2ea4999c8d7bda10dcd,8192f3d76ac4a190fbd67892a6e49e085093435d..266e198914d9e8b35ca5b1f8b9b2a095724d7ec7
--- 1/doc/doc-txt/experimental-spec.txt
--- 2/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@@ -1151,10 -1153,10 +1153,14 @@@ that they are owned by the expected hos
  support to date has not made these checks.
  
  If built with EXPERIMENTAL_CERTNAMES defined, code is
- included to do so, and a new smtp transport option
- "tls_verify_cert_hostname" supported which takes a list of
- names for which the checks must be made.  The host must
- also be in "tls_verify_hosts".
+ included to do so for server certificates, and a new smtp transport option
 -"tls_verify_cert_hostname" supported which takes a list of
 -names for which the checks must be made.  The host must
 -also be in "tls_verify_hosts".
++"tls_verify_cert_hostnames" supported which takes a list of
++names for which the additional checks must be made.
++The option currently defaults to empty, but this may change in
++the future.  "*" is probably a suitable value.
++Whether certificate verification is done at all, and the result of
++it failing, is stll under the control of "tls_verify_hosts" nad
++"tls_try_verify_hosts".
  
  Both Subject and Subject-Alternate-Name certificate fields
  are supported, as are wildcard certificates (limited to

diff --cc src/src/tls-openssl.c
Simple merge