Bug ID: 2372
           Summary: GnuTLS 1.3 and no client cert, required by server,
                    fails to retry in clear
           Product: Exim
           Version: 4.91
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: bug
          Priority: high
         Component: TLS

Possibly associated with late-verification of cert on server; the TLS handshake
succeeds and the client does not see an error until the first data read, for
(crypted) EHLO-response.  This is treated as a dataphase error during TLS, not
as a TLS handshake failure, and the message is queued for retry.  We expect the
retries to fail the same way.

Seen with GnuTLS 3.6.5 on f29, which is about the earliest TLS1.3-capable

Workaround: tls_require_ciphers = NORMAL:-VERS-TLS1.3

You are receiving this mail because:
You are on the CC list for the bug.
## List details at Exim 
details at ##

Reply via email to