On 2018-04-17 at 16:47 +0000, Brandon Long via mailop wrote:
> So, according to our tls folks, that cert is only served to TLS 1.3 clients
> that don't send SNI,
> so they wonder if you're using a pre-release version of OpenSSL without any
> changes.
Yes, Exim supports TLS 1.3 if GnuTLS or OpenSSL does and I'm using
OpenSSL 1.1.1-pre5 (was -pre4 at the time of the above). This system is
one where I'm willing to run pre-production to experience breakage
before others do. Thus threads like this one. :)
draft-ietf-tls-tls13-28 section 9.2 states:
---------------------8< draft-ietf-tls-tls13-28 >8----------------------
In the absence of an application profile standard specifying
otherwise, a TLS-compliant application MUST implement the following
TLS extensions:
[...]
- Server Name Indication ("server_name"; Section 3 of [RFC6066])
---------------------8< draft-ietf-tls-tls13-28 >8----------------------
RFC 3207 is the closest to a profile document which SMTP MX delivery
has, since RFC 7817 explicitly excludes MX coverage. 3207 doesn't
explicitly cover SNI since it predates the earliest RFC I know of
covering SNI. The only standards-track document I know of touching this
topic for SMTP/MX is RFC 7672 for DANE, and for the DANE case, Exim
always sends SNI.
TLS 1.3 _mandating_ SNI is "interesting" for DANE-less SMTP.
For context on my stance: I contributed the initial SNI support for a
bunch of open-source tools several years ago and I added SNI support to
Exim. I think SNI is A Good Thing. This issue is entirely around
_what_ to do for non-DANE TLS for MX delivery.
This morning I already changed my configuration so that in DANE-less
mode, I default to sending SNI matching the mail domain. I can do this
because I run "no_multi_domain" on my SMTP Transports.
I'm tentatively thinking that we should change the Exim defaults here,
to be ready for TLS1.3, and default to multi_domain _disabled_ for the
SMTP Transport and default the value of tls_sni to be $domain as long as
multi_domain is disabled.
Does this seem like a reasonable approach to other postmasters, as an
MTA default?
-Phil, Exim Maintainer hat firmly on
_______________________________________________
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
