Mail server sending to postfix refusing TLS connection with "certificate expired", but it's not

[PMc]

@9peppe

I'm talking about this option:

@PMc

the key is the key, the cert is the cert, and the cacert.pem is the chain, i.e. the collection of intermediate certificates that are needed for the adversary to get to one of their known root ca certs, which obviousely must be sent to the adversary during handshake.

But here the doc talks about something different: it appears to say that the cacert.pem contains a "list of acceptable CAs".

"List of acceptable CAs" can mean "a root store" instead of "the certificate chain."

Ah, thanks, I see. No, it definitely means the chain file here.

But I didn't fully understand this either. So I started to read the tls.c file of sendmail, and got some understanding of what they are doing.
Then I tried to do just the same with openssl s_client - and got the same error!

So, sendmail is out of the loop, and I suppose this can happen with any software for mutual auth that links openssl.

I think over time we will see more of these. Usually when people get that error, they would think, "bah, thats a really old client - it's their problem", and never mind. Only a small percentage comes up to here.