Docs: add note on unusablility of must-staple certs by clients. Bug 2350

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index a073730c61e99427d4b613128c5244fe206c4c5c..37ada7514fb783d15f9c219176f624210b20adfe 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -19007,14 +19007,20 @@ matters.
 
 
 .new
 
 
 .new

-.option set routers string unset
+.option set routers "string list" unset

 .cindex router variables
 .cindex router variables

-This option may be used multiple times on a router.
-Each string given must be of the form $"name = value"$
+This option may be used multiple times on a router;
+because of this the list aspect is mostly irrelevant.
+The list separator is a colon but can be changed in the
+usual way.
+
+Each list-element given must be of the form $"name = value"$

 and the names used must start with the string &"r_"&.
 and the names used must start with the string &"r_"&.

-Strings are accumulated for each router which is run.
+Values containing colons should either have them doubled, or
+the entire list should be prefixed with a list-separator change.

 When a router runs, the strings are evaluated in order,
 When a router runs, the strings are evaluated in order,

-to create variables.
+to create variables which are added to the set associated with
+the address.

 The variable is set with the expansion of the value.
 The variables can be used by the router options
 (not including any preconditions)
 The variable is set with the expansion of the value.
 The variables can be used by the router options
 (not including any preconditions)


@@ -28472,6 +28478,13 @@ transport provide the client with a certificate, which is passed to the server
 if it requests it. If the server is Exim, it will request a certificate only if
 &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
 
 if it requests it. If the server is Exim, it will request a certificate only if
 &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
 

+.new
+Do not use a certificate which has the OCSP-must-staple extension,
+for client use (they are usable for server use).
+As TLS has no means for the client to staple before TLS 1.3 it will result
+in failed connections.
+.wen
+

 If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it
 specifies a collection of expected server certificates.
 These may be
 If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it
 specifies a collection of expected server certificates.
 These may be