This looks like an upstream issue, maybe discuss that with the developers in the comp.mail.sendmail newsgroup or directly report it via the addresses listed here:Package: sendmail-bin Version: 8.18.2-2 Severity: normal Tags: patchDear Maintainer,I was having certificate failures when sending mail to a sendmail submission server and traced the issue down to sendmail not sending the entire cert chain. The reason is that it uses SSL_CTX_use_certificate_file() to read the file and not SSL_CTX_use_certificate_chain_file(). Poking around the sendmail source I noticed that this was gated behind the _FFR_TLS_USE_CERTIFICATE_CHAIN_FILE define. I made a patch to debian/configure.ac to add that, rebuilt the package, and verified that it now sends the whole cert chain.I've attached the patch.I think it's an important feature--nowadays most "real" SSL certs have intermediates in them, especially in the LetsEncrypt/ACME space, and sendmail will not produce a validating cert chain unless this option is enabled.
https://www.proofpoint.com/us/sendmail/faq -- Gruß Marco Muell und Spam bitte an [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
