Fix smtp transport certificate-verification option matching to use correct host

[users/heiko/exim.git] / doc / doc-txt / experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 266e198914d9e8b35ca5b1f8b9b2a095724d7ec7..d57cbf9038a1373755c692ef33f4c40879f6b3f8 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -1154,14 +1154,17 @@ support to date has not made these checks.
 
 If built with EXPERIMENTAL_CERTNAMES defined, code is
 included to do so for server certificates, and a new smtp transport option
 
 If built with EXPERIMENTAL_CERTNAMES defined, code is
 included to do so for server certificates, and a new smtp transport option

-"tls_verify_cert_hostnames" supported which takes a list of
-names for which the additional checks must be made.
+"tls_verify_cert_hostnames" supported which takes a hostlist
+which must match the target host for the additional checks must be made.

 The option currently defaults to empty, but this may change in
 the future.  "*" is probably a suitable value.
 Whether certificate verification is done at all, and the result of
 it failing, is stll under the control of "tls_verify_hosts" nad
 "tls_try_verify_hosts".
 
 The option currently defaults to empty, but this may change in
 the future.  "*" is probably a suitable value.
 Whether certificate verification is done at all, and the result of
 it failing, is stll under the control of "tls_verify_hosts" nad
 "tls_try_verify_hosts".
 

+The name being checked is that for the host, generally
+the result of an MX lookup.
+

 Both Subject and Subject-Alternate-Name certificate fields
 are supported, as are wildcard certificates (limited to
 a single wildcard being the initial component of a 3-or-more
 Both Subject and Subject-Alternate-Name certificate fields
 are supported, as are wildcard certificates (limited to
 a single wildcard being the initial component of a 3-or-more


@@ -1170,7 +1173,7 @@ component FQDN).
 The equivalent check on the server for client certificates is not
 implemented.  At least one major email provider is using a client
 certificate which fails this check.  They do not retry either without
 The equivalent check on the server for client certificates is not
 implemented.  At least one major email provider is using a client
 certificate which fails this check.  They do not retry either without

-hte client certificate or in clear.
+the client certificate or in clear.

 
 It is possible to duplicate the effect of this checking by
 creative use of Events.
 
 It is possible to duplicate the effect of this checking by
 creative use of Events.