Re: adding CA certificates (for use by sendmail)

groenveld@acm.org (John D Groenveld) writes:

# grep CACERT  /usr/local/share/sendmail/cf/README
        define(`confCACERT_PATH', `/etc/mail/certs/')
        define(`confCACERT', `/etc/mail/certs/CA.cert.pem')
confCACERT_PATH         CACertPath      [undefined] Path to directory with
confCACERT              CACertFile      [undefined] File containing at least

Note that CACertPath is for validating servers you connect to
(STARTTLS=client), while CACertFile is for validating clients connecting
to you (STARTTLS=server).

The latter should only contain CAs under your administrative control if
you do client certificate based authentication.  And that's the only
point of having anything there.


Bjørn