Gitweb:
http://git.exim.org/exim.git/commitdiff/3750d68d17a77fe0d51906e49fc09e24c5864a29
Commit: 3750d68d17a77fe0d51906e49fc09e24c5864a29
Parent: 281e72e46c44d316d47ed309dcb0d781a909a181
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Thu Dec 4 18:39:28 2014 +0000
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Thu Dec 4 18:39:28 2014 +0000
Docs: clarify interaction of DANE and CA-based certificate verification options
---
doc/doc-txt/experimental-spec.txt | 11 ++++++++---
1 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index d57cbf9..c3e1196 100644
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -1302,12 +1302,13 @@ MX, A and TLSA records.
A TLSA lookup will be done if either of the above options match
and the host-lookup succeded using dnssec.
-If the TLSA lookup succeeds, a TLS connection will be required
-for the host.
+If a TLSA lookup is done and succeeds, a DANE-verified TLS connection
+will be required for the host.
(TODO: specify when fallback happens vs. when the host is not used)
-If dane is in use the following transport options are ignored:
+If DANE is requested and useable (see above) the following transport
+options are ignored:
hosts_require_tls
tls_verify_hosts
tls_try_verify_hosts
@@ -1315,6 +1316,10 @@ If dane is in use the following transport options are ignored:
tls_crl
tls_verify_cert_hostnames
+If DANE is not usable, whether requested or not, and CA-anchored
+verification evaluation is wanted, the above variables should be set
+appropriately.
+
Currently dnssec_request_domains must be active (need to think about that)
and dnssec_require_domains is ignored.
