[Exim] SSL certificates on multihomed hosts

Top Page
Delete this message
Reply to this message
Author: Marek Michalkiewicz
Date:  
To: exim-users
Subject: [Exim] SSL certificates on multihomed hosts
Hello,

I'm running Exim 4.22 (as packaged in Debian "testing"). Everything
works fine, except that there is one thing I don't know how to do...

I'm trying to set up SMTP AUTH over TLS encrypted connections, using
a self-signed certificate. The certificate should have the correct
host name specified as commonName - now, the host has more than one
network interface (a few different host names), clients can connect
to each of them, but the config file can specify only one certificate.

uw-imapd solves this problem by reading the certificate from the file
/etc/ssl/certs/imapd-aaa.bbb.ccc.ddd.pem (where aaa.bbb.ccc.ddd is
the local IP address of the interface where the connection came from).

If commonName in the certificate does not match the hostname, the
mail user agent complains. Decent MUAs like Mozilla and KMail at
least can be told to accept the certificate anyway and never ask this
question again, but M$ Outlook Express can't (asks the same question
very often, only yes/no answer possible, no "yes to all").

I guess it may be possible to run a few separate copies of Exim,
one for each interface, with its own configuration files to specify
different certificates - but that looks very complicated to me, as
the configuration is the same, all I need is different certificates
depending on local IP of the incoming connection (as in uw-imapd).

Please consider adding this feature to Exim (unless there is already
a way to do this). If not, I may have to convince the M$ OE users
to switch to Mozilla Mail - probably not a bad idea anyway ;-)

Thanks,
Marek