[PATCH] upas/smtpd: use the full chain of certificates with TLS Otherwise, the other side won't be able to verify our certfificate. Google will report this with the smtp-tls report. --- diff 2cbda95fa2b7f49e11e86087b9718fde32cb11ad 9d0275079df5d31ba6c0e26f9bc1aaf5710a3501 --- a/sys/src/cmd/upas/smtp/smtpd.c +++ b/sys/src/cmd/upas/smtp/smtpd.c @@ -1585,8 +1585,7 @@ void starttls(void) { - int certlen, fd; - uchar *cert; + int fd; TLSconn conn; if (tlscert == nil) { @@ -1593,15 +1592,16 @@ reply("500 5.5.1 illegal command or bad syntax\r\n"); return; } - cert = readcert(tlscert, &certlen); - if (cert == nil) { + memset(&conn, 0, sizeof(conn)); + conn.chain = readcertchain(tlscert); + if (conn.chain == nil) { reply("454 4.7.5 TLS not available\r\n"); return; } reply("220 2.0.0 Go ahead make my day\r\n"); - memset(&conn, 0, sizeof(conn)); - conn.cert = cert; - conn.certlen = certlen; + conn.cert = conn.chain->pem; + conn.certlen = conn.chain->pemlen; + conn.chain = conn.chain->next; fd = tlsServer(Bfildes(&bin), &conn); if (fd < 0) { syslog(0, "smtpd", "TLS start-up failed with %s", him);