SERVER=
-exim_path = EXIM_PATH
-host_lookup_order = bydns
+.include DIR/aux-var/tls_conf_prefix
+
primary_hostname = myhost.test.ex
-rfc1413_query_timeout = 0s
-spool_directory = DIR/spool
-log_file_path = DIR/spool/log/SERVER%slog
-gecos_pattern = ""
-gecos_name = CALLER_NAME
FX = DIR/aux-fixed
S1 = FX/exim-ca/example.com/server1.example.com
retry_use_local_part
transport = send_to_server_req_passname
+client_t:
+ driver = accept
+ local_parts = usert
+ retry_use_local_part
+ transport = send_to_server_req_failchain
+
+client_u:
+ driver = accept
+ local_parts = useru
+ retry_use_local_part
+ transport = send_to_server_req_passchain
+
# ----- Transports -----
driver = smtp
allow_localhost
hosts = HOSTIPV4
- hosts_require_tls = HOSTIPV4
port = PORT_D
+ hosts_try_fastopen = :
+ hosts_require_tls = HOSTIPV4
tls_certificate = CERT2
tls_privatekey = CERT2
driver = smtp
allow_localhost
hosts = HOSTIPV4 : 127.0.0.1
- hosts_require_tls = HOSTIPV4
port = PORT_D
+ hosts_try_fastopen = :
+ hosts_require_tls = HOSTIPV4
tls_certificate = CERT2
tls_privatekey = CERT2
driver = smtp
allow_localhost
hosts = HOSTIPV4
- hosts_require_tls = HOSTIPV4
port = PORT_D
+ hosts_try_fastopen = :
+ hosts_require_tls = HOSTIPV4
tls_certificate = CERT2
tls_privatekey = CERT2
allow_localhost
hosts = HOSTIPV4
port = PORT_D
+ hosts_try_fastopen = :
tls_certificate = CERT2
tls_privatekey = CERT2
# this will fail to verify the cert name and fallback to unencrypted
send_to_server_req_failname:
- driver = smtp
+ driver = smtp
allow_localhost
- hosts = HOSTIPV4
- port = PORT_D
- tls_certificate = CERT2
- tls_privatekey = CERT2
+ hosts = serverbadname.example.com
+ port = PORT_D
+ hosts_try_fastopen = :
+ tls_certificate = CERT2
+ tls_privatekey = CERT2
- tls_verify_certificates = CA1
- tls_verify_cert_hostnames = server1.example.net : server1.example.org
- tls_verify_hosts = *
+ tls_verify_certificates = CA1
+ tls_verify_cert_hostnames = HOSTIPV4
+ tls_verify_hosts = *
# this will pass the cert verify including name check
send_to_server_req_passname:
- driver = smtp
+ driver = smtp
+ allow_localhost
+ hosts = server1.example.com
+ port = PORT_D
+ hosts_try_fastopen = :
+ tls_certificate = CERT2
+ tls_privatekey = CERT2
+
+ tls_verify_certificates = CA1
+ tls_verify_cert_hostnames = HOSTIPV4
+ tls_verify_hosts = *
+
+ # this will fail the cert verify name check, because CNAME rules
+ send_to_server_req_failchain:
+ driver = smtp
+ allow_localhost
+ hosts = serverchain1.example.com
+ port = PORT_D
+ hosts_try_fastopen = :
+ tls_certificate = CERT2
+ tls_privatekey = CERT2
+
+ tls_verify_certificates = CA1
+ tls_verify_cert_hostnames = HOSTIPV4
+ tls_verify_hosts = *
+
+ # this will pass the cert verify name check, because CNAME rules
+ send_to_server_req_passchain:
+ driver = smtp
allow_localhost
- hosts = HOSTIPV4
- port = PORT_D
- tls_certificate = CERT2
- tls_privatekey = CERT2
+ hosts = alternatename.server1.example.com
+ port = PORT_D
+ hosts_try_fastopen = :
+ tls_certificate = CERT2
+ tls_privatekey = CERT2
- tls_verify_certificates = CA1
- tls_verify_cert_hostnames = noway.example.com : server1.example.com
- tls_verify_hosts = *
+ tls_verify_certificates = CA1
+ tls_verify_cert_hostnames = HOSTIPV4
+ tls_verify_hosts = *
# End