9.706-9 EXIM: SSL verify error: depth=0 error=unable to get local issuer certificate cert=/CN

Hi Harsh

So there is not intermediate cert. store on UTM which Exim could use? Will this be corrected?

Reagrds, Peter

Well, that's what i wrote 5 days ago and brings me to pebo's question.

Hi Dominik Telgmann,

If you're a licensed user, open a support case and send me the case number via personal message. 

Thanks,

The update to version 9.706-9 helped us. The email attachments will arrive correctly. The TLS notice remains.

Same issue here with 9.705-7 and a Thawte Wildcard SSL certificate. The SSL error fills up the SMTP log file.

When will TLS issue be fixed?

Hi folks!

So I just checked this reported eror for myself and I came to the conclusion, that there is definetly something not right:

I was on Firmware 9.705-3 and installed the Exim Patch Update to 9.705-7 on 13.05.2021

So I check the SMTP Logs before and after that date.

Before: (just some sample days)

After the Update:

Nothing changed regarding certificates. All the same. No Let's encrypt renew, nothing.

I think that the verification has never worked but was not tested before by EXIM. But with the new EXIM Version the verification is enabled and is throwing a warning now.

I doubt that, because I remember setting "Any" in SMTP -> Advanced -> Require TLS Negotiation Hosts to force the use of TLS Encryption.

After the configuration change lots of mail did not get delivered, however not because of the mandatory TLS, but because of uncorrect certs from the remote MTA. Those certs did not match the mx domain.

So therefore I think that the UTM always did this cert checks.

Also this looks right to me:

Bug: verification of wildcard certificates fails: 

SSL verify error (during R-verify for [XX.XX.X.XXX]): certificate name mismatch: DN="/CN=*.DOMAIN.COM" H="XX.XX.X.XXX"