Mechiel Lukkien f7666d1582 fix verifying dane-ta connections for outgoing email where the dane-ta record is not for the first certificate in the chain after the leaf certifiate. ... tls servers send a list of certificates for the connection. the first is the leaf certificate. that's the one for the server itself. that's the one we want to verify. the others are intermediate CA's. and possibly even the root CA certificate that it hopes is trusted at the client (though sending it doesn't make it trusted). with dane-ta, the public key of an intermediate or root CA certificate is listed in the TSLA record. when verifying, we add any intermediate/root CA that matches a dane-ta tlsa record to the trusted root CA certs. we should also have added CA certs that didn't match a TLSA record to the "intermediates" of x509.VerifyOptions. because we didn't, x509.Certificate.Verify couldn't verify the chain from the trusted dane-ta ca cert to the leaf cert. we would only properly verify a dane-ta connection correctly if the dane-ta-trusted ca cert was the one immediately following the leaf cert. not when there were one or more additional intermediate certs. this showed when connecting to mx.runbox.com. problem reported by robbo5000 on matrix, thanks!		2024-12-21 16:09:53 +01:00
..
dane.go	fix verifying dane-ta connections for outgoing email where the dane-ta record is not for the first certificate in the chain after the leaf certifiate.	2024-12-21 16:09:53 +01:00
dane_test.go	use debug logging in tests	2024-05-10 15:51:48 +02:00
examples_test.go	replace packages slog and slices from golang.org/x/exp with stdlib	2024-02-08 14:49:01 +01:00