diff --git a/ChangeLog b/ChangeLog index cbf3ae9..c189116 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,11 +1,17 @@ E-MailRelay Change Log ====================== +2.3 -> 2.3.1 +------------ +* Hourly log file rotation using "%h" (eg. "--log-file=log.%d.%h"). +* TLS key and certificate files can be specified separately. +* Fixed error handling for network client filters ("--client-filter=net:...") [bug-id #50]. + 2.2 -> 2.3 ---------- * Unix domain sockets supported (eg. "--interface=/tmp/smtp.s"). * Windows event log not used for verbose logging (prefer "--log-file"). -* New admin 'forward' command to trigger forwarding without waiting. +* New admin "forward" command to trigger forwarding without waiting. * Optional base64 encoding of passwords in secrets files ("plain:b"). * Support for MbedTLS version 3. diff --git a/NEWS b/NEWS index d0d4d31..7a931e8 100644 --- a/NEWS +++ b/NEWS @@ -1,5 +1,7 @@ News ---- Version 2.3 is a relatively minor release. The main functional change is to -support unix domain sockets. Non-functional code changes include better +support unix domain sockets. Non-functional code changes include better separation of interface and implementation in the SMTP message store. + +Version 2.3.1 is a point release principally to fix bug-id #50. diff --git a/VERSION b/VERSION index bb576db..2bf1c1c 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.3 +2.3.1 diff --git a/bin/Makefile.am b/bin/Makefile.am index 3b6b7ee..2ed57f1 100644 --- a/bin/Makefile.am +++ b/bin/Makefile.am @@ -17,6 +17,8 @@ example_scripts_static = \ emailrelay-bcc-check.pl \ + emailrelay-check-ipaddress.js \ + emailrelay-check-ipaddress.pl \ emailrelay-ldap-verify.py \ emailrelay-multicast.sh \ emailrelay-rot13.pl \ diff --git a/bin/Makefile.in b/bin/Makefile.in index 79dea1e..9d94961 100644 --- a/bin/Makefile.in +++ b/bin/Makefile.in @@ -284,6 +284,8 @@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ example_scripts_static = \ emailrelay-bcc-check.pl \ + emailrelay-check-ipaddress.js \ + emailrelay-check-ipaddress.pl \ emailrelay-ldap-verify.py \ emailrelay-multicast.sh \ emailrelay-rot13.pl \ diff --git a/bin/emailrelay-check-ipaddress.js b/bin/emailrelay-check-ipaddress.js new file mode 100755 index 0000000..f3c51d1 --- /dev/null +++ b/bin/emailrelay-check-ipaddress.js @@ -0,0 +1,49 @@ +// +// Copyright (C) 2001-2022 Graeme Walker +// +// Copying and distribution of this file, with or without modification, +// are permitted in any medium without royalty provided the copyright +// notice and this notice are preserved. This file is offered as-is, +// without any warranty. +// === +// +// emailrelay-check-ipaddress.js +// +// An example "--filter" script for Windows that verifies the submitting +// client's IP address. The IP address is read from the envelope file. +// Invalid IP addresses are rejected by deleting the two message files and +// exiting with the special exit code of 100. Note that this checks the +// IP address very late in the submission process; a firewall or DNSBL check +// might work better. +// +try +{ + var content = WScript.Arguments(0) ; + var envelope = WScript.Arguments(1) ; + var fs = WScript.CreateObject( "Scripting.FileSystemObject" ) ; + var ts = fs.OpenTextFile( envelope , 1 , false ) ; + var txt = ts.ReadAll() ; + ts.Close() ; + var re = new RegExp( "X-MailRelay-Client: (\\S*)" , "m" ) ; + var ip = txt.match(re)[1] ; + var ok = ip === "1.1.1.1" ; /// edit here + if( ok ) + { + WScript.Quit( 0 ) ; + } + else + { + WScript.StdOut.WriteLine( "<>" ) ; + fs.DeleteFile( envelope ) ; + fs.DeleteFile( content ) ; + WScript.Quit( 100 ) ; + } +} +catch( e ) +{ + // report errors using the special <<...>> markers + WScript.StdOut.WriteLine( "<>" ) ; + WScript.StdOut.WriteLine( "<<" + e + ">>" ) ; + WScript.Quit( 1 ) ; +} + diff --git a/bin/emailrelay-check-ipaddress.pl b/bin/emailrelay-check-ipaddress.pl new file mode 100755 index 0000000..c0d4fd8 --- /dev/null +++ b/bin/emailrelay-check-ipaddress.pl @@ -0,0 +1,52 @@ +#!/usr/bin/env perl +# +# Copyright (C) 2001-2022 Graeme Walker +# +# Copying and distribution of this file, with or without modification, +# are permitted in any medium without royalty provided the copyright +# notice and this notice are preserved. This file is offered as-is, +# without any warranty. +# === +# +# emailrelay-check-ipaddress.pl +# +# An example "--filter" script that verifies the submitting client's IP +# address. The IP address is read from the envelope file. Invalid IP +# addresses are rejected by deleting the two message files and exiting +# with the special exit code of 100. Note that this checks the IP +# address very late in the submission process; a firewall or DNSBL +# check might work better. +# + +use strict ; +use warnings ; +use FileHandle ; +$SIG{__DIE__} = sub { (my $e = join(" ",@_)) =~ s/\n/ /g ; print "<>\n<>\n" ; exit 99 } ; + +my %allow = ( + "127.0.0.1" => 1 , + "1.1.1.1" => 1 , + # etc +) ; + +my $content = $ARGV[0] or die "usage error\n" ; +my $envelope = $ARGV[1] or die "usage error\n" ; +my $fh = new FileHandle( $envelope ) or die "cannot open envelope file: $!\n" ; +my $txt ; +{ + local $/ = undef ; + $txt = <$fh> ; +} +my ( $ip ) = ( $txt =~ m/X-MailRelay-Client: (\S*)/m ) ; +if( $allow{$ip} ) +{ + exit( 0 ) ; +} +else +{ + print "<>\n<>\n" ; + unlink( $content ) ; + unlink( $envelope ) ; + exit( 100 ) ; +} + diff --git a/configure b/configure index 3207ae7..d8daa73 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for E-MailRelay 2.3. +# Generated by GNU Autoconf 2.69 for E-MailRelay 2.3.1. # # # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. @@ -577,8 +577,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='E-MailRelay' PACKAGE_TARNAME='emailrelay' -PACKAGE_VERSION='2.3' -PACKAGE_STRING='E-MailRelay 2.3' +PACKAGE_VERSION='2.3.1' +PACKAGE_STRING='E-MailRelay 2.3.1' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1375,7 +1375,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures E-MailRelay 2.3 to adapt to many kinds of systems. +\`configure' configures E-MailRelay 2.3.1 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1442,7 +1442,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of E-MailRelay 2.3:";; + short | recursive ) echo "Configuration of E-MailRelay 2.3.1:";; esac cat <<\_ACEOF @@ -1575,7 +1575,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -E-MailRelay configure 2.3 +E-MailRelay configure 2.3.1 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2011,7 +2011,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by E-MailRelay $as_me 2.3, which was +It was created by E-MailRelay $as_me 2.3.1, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2876,7 +2876,7 @@ fi # Define the identity of the package. PACKAGE='emailrelay' - VERSION='2.3' + VERSION='2.3.1' # Some tools Automake needs. @@ -10728,7 +10728,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by E-MailRelay $as_me 2.3, which was +This file was extended by E-MailRelay $as_me 2.3.1, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -10794,7 +10794,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -E-MailRelay config.status 2.3 +E-MailRelay config.status 2.3.1 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff --git a/configure.ac b/configure.ac index b3a5ef2..ce310ba 100755 --- a/configure.ac +++ b/configure.ac @@ -19,7 +19,7 @@ dnl dnl Process this file with autoconf to produce a configure script. dnl -AC_INIT([E-MailRelay],[2.3],[],[emailrelay]) +AC_INIT([E-MailRelay],[2.3.1],[],[emailrelay]) AC_CONFIG_SRCDIR([src/glib/gdef.h]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE([no-define]) diff --git a/debian/changelog b/debian/changelog index 0a024f8..95ebbd7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +emailrelay (2.3.1) unstable; urgency=low + * Hourly log file rotation using "%h" (eg. "--log-file=log.%d.%h"). + * TLS key and certificate files can be specified separately. + * Fixed error handling for network client filters ("--client-filter=net:...") [bug-id 50]. + -- maintainer graeme_walker Thu, 30 Jun 2022 00:00:00 +0000 + emailrelay (2.3) unstable; urgency=low * Unix domain sockets supported (eg. "--interface=/tmp/smtp.s"). * Windows event log not used for verbose logging (prefer "--log-file"). diff --git a/doc/changelog.html b/doc/changelog.html index bd5062b..b62db6c 100644 --- a/doc/changelog.html +++ b/doc/changelog.html @@ -9,6 +9,12 @@

E-MailRelay Change Log

+

2.3 -> 2.3.1

+
    +
  • Hourly log file rotation using %h (eg. --log-file=log.%d.%h).
    • +
  • TLS key and certificate files can be specified separately.
    • +
  • Fixed error handling for network client filters (--client-filter=net:...) [bug-id #50].
    • +

2.2 -> 2.3

  • Unix domain sockets supported (eg. --interface=/tmp/smtp.s.
    • diff --git a/doc/changelog.md b/doc/changelog.md index ec4e9dc..d8aed12 100644 --- a/doc/changelog.md +++ b/doc/changelog.md @@ -1,6 +1,13 @@ E-MailRelay Change Log ====================== +2.3 -> 2.3.1 +------------ + +* Hourly log file rotation using `%h` (eg. `--log-file=log.%d.%h`). +* TLS key and certificate files can be specified separately. +* Fixed error handling for network client filters (`--client-filter=net:...`) [bug-id #50]. + 2.2 -> 2.3 ---------- diff --git a/doc/changelog.rst b/doc/changelog.rst index 3312174..b0ca93f 100644 --- a/doc/changelog.rst +++ b/doc/changelog.rst @@ -2,6 +2,13 @@ E-MailRelay Change Log ********************** +2.3 -> 2.3.1 +============ + +* Hourly log file rotation using *%h* (eg. *--log-file=log.%d.%h*). +* TLS key and certificate files can be specified separately. +* Fixed error handling for network client filters (*--client-filter=net:...*) [bug-id #50]. + 2.2 -> 2.3 ========== diff --git a/doc/changelog.txt b/doc/changelog.txt index a2cb5eb..c189116 100644 --- a/doc/changelog.txt +++ b/doc/changelog.txt @@ -1,6 +1,12 @@ E-MailRelay Change Log ====================== +2.3 -> 2.3.1 +------------ +* Hourly log file rotation using "%h" (eg. "--log-file=log.%d.%h"). +* TLS key and certificate files can be specified separately. +* Fixed error handling for network client filters ("--client-filter=net:...") [bug-id #50]. + 2.2 -> 2.3 ---------- * Unix domain sockets supported (eg. "--interface=/tmp/smtp.s"). diff --git a/doc/emailrelay-man.html b/doc/emailrelay-man.html index 0a43183..d07cb10 100644 --- a/doc/emailrelay-man.html +++ b/doc/emailrelay-man.html @@ -119,7 +119,7 @@ Enables negotiated TLS for outgoing SMTP connections; the SMTP STARTTLS command
    --client-tls-certificate <pem-file>
    -Defines the TLS certificate file when acting as a SMTP client. This file must contain the client's private key and certificate chain using the PEM file format. Keep the file permissions tight to avoid accidental exposure of the private key. +Defines the TLS certificate file when acting as a SMTP client. This file must contain the client's private key and certificate chain using the PEM file format. Alternatively, use this option twice with the first one specifying the key file and the second the certificate file. Keep the file permissions tight to avoid accidental exposure of the private key.
    -b, --client-tls-connection
    @@ -135,7 +135,7 @@ Defines the target server hostname in the TLS handshake. With --client-tls-co
    --client-tls-verify <ca-list>
    -Enables verification of the remote SMTP server's certificate against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root certificate. +Enables verification of the remote SMTP server's certificate against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root certificate. Specify <default> for the TLS library's default set of trusted CAs.
    --client-tls-verify-name <cname>
    @@ -143,7 +143,7 @@ Enables verification of the CNAME within the remote SMTP server's certificate.
    -e, --close-stderr
    -Causes the standard error stream to be closed soon after start-up. This is useful when operating as a backgroud daemon and it is therefore implied by --as-server and --as-proxy. +Causes the standard error stream to be closed soon after start-up. This is useful when operating as a background daemon and it is therefore implied by --as-server and --as-proxy.
    -U, --connection-timeout <time>
    @@ -243,7 +243,7 @@ Disables logging to the syslog. Note that --as-client implies --no-sys
    -i, --pid-file <pid-file>
    -Causes the process-id to be written into the specified file when the program starts up, typically after it has become a backgroud daemon. +Causes the process-id to be written into the specified file when the program starts up, typically after it has become a background daemon.
    -O, --poll <period>
    @@ -299,7 +299,7 @@ Enables TLS for incoming SMTP and POP connections. SMTP clients can then request
    --server-tls-certificate <pem-file>
    -Defines the TLS certificate file when acting as a SMTP or POP server. This file must contain the server's private key and certificate chain using the PEM file format. Keep the file permissions tight to avoid accidental exposure of the private key. +Defines the TLS certificate file when acting as a SMTP or POP server. This file must contain the server's private key and certificate chain using the PEM file format. Alternatively, use this option twice with the first one specifying the key file and the second the certificate file. Keep the file permissions tight to avoid accidental exposure of the private key.
    --server-tls-connection
    @@ -311,7 +311,7 @@ Makes the use of TLS mandatory for any incoming SMTP and POP connections. SMTP c
    --server-tls-verify <ca-list>
    -Enables verification of remote SMTP and POP clients' certificates against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root certificate. +Enables verification of remote SMTP and POP clients' certificates against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root certificate. Specify <default> for the TLS library's default set of trusted CAs.
    -M, --size <bytes>
    @@ -366,8 +366,7 @@ Graeme Walker, mailto:graem
    This document was created by -    man2html, +man2html, using the manual pages.
    - diff --git a/doc/emailrelay.1 b/doc/emailrelay.1 index 3bb3d6b..b4d099c 100644 --- a/doc/emailrelay.1 +++ b/doc/emailrelay.1 @@ -89,7 +89,7 @@ Specifies the IP network address to be used to bind the local end of outgoing SM Enables negotiated TLS for outgoing SMTP connections; the SMTP STARTTLS command will be issued if the remote server supports it. .TP .B --client-tls-certificate \fI\fR -Defines the TLS certificate file when acting as a SMTP client. This file must contain the client's private key and certificate chain using the PEM file format. Keep the file permissions tight to avoid accidental exposure of the private key. +Defines the TLS certificate file when acting as a SMTP client. This file must contain the client's private key and certificate chain using the PEM file format. Alternatively, use this option twice with the first one specifying the key file and the second the certificate file. Keep the file permissions tight to avoid accidental exposure of the private key. .TP .B \-b, --client-tls-connection Enables the use of a TLS tunnel for outgoing SMTP connections. This is for SMTP over TLS (SMTPS), not TLS negotiated within SMTP using STARTTLS. @@ -101,13 +101,13 @@ Makes the use of TLS mandatory for outgoing SMTP connections. The SMTP STARTTLS Defines the target server hostname in the TLS handshake. With \fI--client-tls-connection\fR this can be used for SNI, allowing the remote server to adopt an appropriate identity. .TP .B --client-tls-verify \fI\fR -Enables verification of the remote SMTP server's certificate against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root certificate. +Enables verification of the remote SMTP server's certificate against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root certificate. Specify \fI\fR for the TLS library's default set of trusted CAs. .TP .B --client-tls-verify-name \fI\fR Enables verification of the CNAME within the remote SMTP server's certificate. .TP .B \-e, --close-stderr -Causes the standard error stream to be closed soon after start-up. This is useful when operating as a backgroud daemon and it is therefore implied by \fI--as-server\fR and \fI--as-proxy\fR. +Causes the standard error stream to be closed soon after start-up. This is useful when operating as a background daemon and it is therefore implied by \fI--as-server\fR and \fI--as-proxy\fR. .TP .B \-U, --connection-timeout \fI
    Defines the TLS certificate file when acting as a SMTP client. This file must contain the client's private key and certificate chain using the PEM file - format. Keep the file permissions tight to avoid accidental exposure of the - private key. + format. Alternatively, use this option twice with the first one specifying + the key file and the second the certificate file. Keep the file permissions + tight to avoid accidental exposure of the private key.
    --client-tls-connection (-b)
    @@ -137,7 +138,8 @@ Enables verification of the remote SMTP server's certificate against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root - certificate. + certificate. Specify <default> for the TLS library's default set of + trusted CAs.
    --client-tls-verify-name <cname>
    @@ -147,7 +149,7 @@
    --close-stderr (-e)
    Causes the standard error stream to be closed soon after start-up. This is - useful when operating as a backgroud daemon and it is therefore implied by + useful when operating as a background daemon and it is therefore implied by --as-server and --as-proxy.
    --connection-timeout <time> (-U)
    @@ -301,7 +303,7 @@
    --pid-file <pid-file> (-i)
    Causes the process-id to be written into the specified file when the program - starts up, typically after it has become a backgroud daemon. + starts up, typically after it has become a background daemon.
    --poll <period> (-O)
    @@ -392,8 +394,9 @@
    Defines the TLS certificate file when acting as a SMTP or POP server. This file must contain the server's private key and certificate chain using the - PEM file format. Keep the file permissions tight to avoid accidental - exposure of the private key. + PEM file format. Alternatively, use this option twice with the first one + specifying the key file and the second the certificate file. Keep the file + permissions tight to avoid accidental exposure of the private key.
    --server-tls-connection
    @@ -411,7 +414,8 @@ Enables verification of remote SMTP and POP clients' certificates against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root - certificate. + certificate. Specify <default> for the TLS library's default set of + trusted CAs.
    --size <bytes> (-M)
    diff --git a/doc/reference.md b/doc/reference.md index e23157c..1f1eda4 100644 --- a/doc/reference.md +++ b/doc/reference.md @@ -98,8 +98,9 @@ where <option> is: Defines the TLS certificate file when acting as a SMTP client. This file must contain the client's private key and certificate chain using the PEM file - format. Keep the file permissions tight to avoid accidental exposure of the - private key. + format. Alternatively, use this option twice with the first one specifying + the key file and the second the certificate file. Keep the file permissions + tight to avoid accidental exposure of the private key. * \-\-client-tls-connection (-b) @@ -123,7 +124,8 @@ where <option> is: Enables verification of the remote SMTP server's certificate against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root - certificate. + certificate. Specify `` for the TLS library's default set of + trusted CAs. * \-\-client-tls-verify-name <cname> @@ -133,7 +135,7 @@ where <option> is: * \-\-close-stderr (-e) Causes the standard error stream to be closed soon after start-up. This is - useful when operating as a backgroud daemon and it is therefore implied by + useful when operating as a background daemon and it is therefore implied by `--as-server` and `--as-proxy`. * \-\-connection-timeout <time> (-U) @@ -287,7 +289,7 @@ where <option> is: * \-\-pid-file <pid-file> (-i) Causes the process-id to be written into the specified file when the program - starts up, typically after it has become a backgroud daemon. + starts up, typically after it has become a background daemon. * \-\-poll <period> (-O) @@ -378,8 +380,9 @@ where <option> is: Defines the TLS certificate file when acting as a SMTP or POP server. This file must contain the server's private key and certificate chain using the - PEM file format. Keep the file permissions tight to avoid accidental - exposure of the private key. + PEM file format. Alternatively, use this option twice with the first one + specifying the key file and the second the certificate file. Keep the file + permissions tight to avoid accidental exposure of the private key. * \-\-server-tls-connection @@ -397,7 +400,8 @@ where <option> is: Enables verification of remote SMTP and POP clients' certificates against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root - certificate. + certificate. Specify `` for the TLS library's default set of + trusted CAs. * \-\-size <bytes> (-M) diff --git a/doc/reference.rst b/doc/reference.rst index 81d6826..80b303f 100644 --- a/doc/reference.rst +++ b/doc/reference.rst @@ -101,8 +101,9 @@ where \ is: Defines the TLS certificate file when acting as a SMTP client. This file must contain the client's private key and certificate chain using the PEM file - format. Keep the file permissions tight to avoid accidental exposure of the - private key. + format. Alternatively, use this option twice with the first one specifying + the key file and the second the certificate file. Keep the file permissions + tight to avoid accidental exposure of the private key. * --client-tls-connection (-b) @@ -126,7 +127,8 @@ where \ is: Enables verification of the remote SMTP server's certificate against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root - certificate. + certificate. Specify *\* for the TLS library's default set of + trusted CAs. * --client-tls-verify-name \ @@ -136,7 +138,7 @@ where \ is: * --close-stderr (-e) Causes the standard error stream to be closed soon after start-up. This is - useful when operating as a backgroud daemon and it is therefore implied by + useful when operating as a background daemon and it is therefore implied by *--as-server* and *--as-proxy*. * --connection-timeout \ (-U) @@ -290,7 +292,7 @@ where \ is: * --pid-file \ (-i) Causes the process-id to be written into the specified file when the program - starts up, typically after it has become a backgroud daemon. + starts up, typically after it has become a background daemon. * --poll \ (-O) @@ -381,8 +383,9 @@ where \ is: Defines the TLS certificate file when acting as a SMTP or POP server. This file must contain the server's private key and certificate chain using the - PEM file format. Keep the file permissions tight to avoid accidental - exposure of the private key. + PEM file format. Alternatively, use this option twice with the first one + specifying the key file and the second the certificate file. Keep the file + permissions tight to avoid accidental exposure of the private key. * --server-tls-connection @@ -400,7 +403,8 @@ where \ is: Enables verification of remote SMTP and POP clients' certificates against any of the trusted CA certificates in the specified file or directory. In many use cases this should be a file containing just your self-signed root - certificate. + certificate. Specify *\* for the TLS library's default set of + trusted CAs. * --size \ (-M) diff --git a/doc/reference.txt b/doc/reference.txt index a92ca4f..b1f2787 100644 --- a/doc/reference.txt +++ b/doc/reference.txt @@ -85,8 +85,9 @@ where