acl_smtp_helo = check_helo
acl_smtp_rcpt = check_recipient
-log_selector = +received_recipients +tls_resumption
+log_selector = +received_recipients +tls_resumption +tls_peerdn
openssl_options = +no_sslv2 +no_sslv3 +single_dh_use OPTION
tls_advertise_hosts = *
check_helo:
accept condition = ${if def:tls_in_cipher}
- logwrite = tls_in_resumption ${listextract {$tls_in_resumption} {_RESUME_DECODE}}
+ logwrite = tls_in_resumption\t${listextract {$tls_in_resumption} {_RESUME_DECODE}}
+ logwrite = our cert subject\t${certextract {subject}{$tls_in_ourcert}}
+ logwrite = peer cert subject\t${certextract {subject}{$tls_in_peercert}}
+ logwrite = peer cert verified\t${tls_in_certificate_verified}
+ logwrite = peer dn\t${tls_in_peerdn}
+ logwrite = ocsp\t${tls_in_ocsp}
+ logwrite = cipher\t${tls_in_cipher}
+ logwrite = bits\t${tls_in_bits}
accept
check_recipient:
accept condition = ${if def:tls_out_cipher}
condition = ${if eq {$event_name}{tcp:close}}
logwrite = tls_out_resumption ${listextract {$tls_out_resumption} {_RESUME_DECODE}}
+ logwrite = our cert subject\t${certextract {subject}{$tls_out_ourcert}}
+ logwrite = peer cert subject\t${certextract {subject}{$tls_out_peercert}}
+ logwrite = peer cert verified\t${tls_out_certificate_verified}
+ logwrite = peer dn\t${tls_out_peerdn}
+ logwrite = ocsp\t${tls_out_ocsp}
+ logwrite = cipher\t${tls_out_cipher}
+ logwrite = bits\t${tls_out_bits}
# ----- Routers -----
begin routers
client:
- driver = accept
- condition = ${if eq {SERVER}{server}{no}{yes}}
- retry_use_local_part
- transport = send_to_server${if eq{$local_part}{abcd}{2}{1}}
+ driver = accept
+ condition = ${if eq {SERVER}{server}{no}{yes}}
+ transport = send_to_server${if eq{$local_part}{abcd}{2}{1}}
server:
driver = redirect
begin transports
send_to_server1:
- driver = smtp
+ driver = smtp
allow_localhost
- hosts = 127.0.0.1
- port = PORT_D
- helo_data = helo.data.changed
+ hosts = 127.0.0.1
+ port = PORT_D
+ helo_data = helo.data.changed
.ifdef VALUE
- tls_resumption_hosts = *
+ tls_resumption_hosts = *
.else
- tls_resumption_hosts = :
+ tls_resumption_hosts = :
.endif
- event_action = ${acl {log_resumption}}
+ tls_verify_certificates = DIR/aux-fixed/cert1
+ tls_verify_cert_hostnames = ${if match {$local_part}{^noverify} {*}{:}}
+ tls_try_verify_hosts = *
+ event_action = ${acl {log_resumption}}
send_to_server2:
driver = smtp
allow_localhost
hosts = HOSTIPV4
port = PORT_D
+ tls_verify_certificates = DIR/aux-fixed/cert1
+ tls_verify_cert_hostnames = :
event_action = ${acl {log_resumption}}