From: Jeremy Harris <jgh146exb@wizmail.org>
Date: Thu, 4 Dec 2014 19:17:47 +0000 (+0000)
Subject: Fail a DANE-mode verify on totally missing certificate
X-Git-Tag: exim-4_85_RC3~7
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/02af313dc5374b79f04fd9961b74835dcc0389e8?ds=sidebyside

Fail a DANE-mode verify on totally missing certificate
---

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 9aa655e82..c23ac031f 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1872,7 +1872,9 @@ if (expciphers != NULL)
 #ifdef EXPERIMENTAL_DANE
 if (tlsa_dnsa)
   {
-  SSL_CTX_set_verify(client_ctx, SSL_VERIFY_PEER, verify_callback_client_dane);
+  SSL_CTX_set_verify(client_ctx,
+    SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+    verify_callback_client_dane);
 
   if (!DANESSL_library_init())
     return tls_error(US"library init", host, NULL);