Re: Problem with FEATURE(`sts'): bogus "not listed in SANs" rejects

Marco Moock <mm+usenet-es@dorfdsl.de> writes:

On 29.10.2024 09:16 Uhr Bjørn Mork wrote:
>

This seemed to work pretty well, but yesterday I noticed a problem:
Some emails were temporarily rejected with an unexpected "not listed
in SANs" message.  This was unexpexted because most of the affected
emails were for MXes hosted by Microsoft and their
"protection.outlook.com" service.

>
Which logging options do you use?
I maybe have the same problem with gmail/MS and STS with their
certificates, but the logging just says and verify=FAIL
<itex-rua@microsoft.com>... Deferred: 403 4.7.0 authentication failed

I'm usually running with

 define(`confLOG_LEVEL', `10')dnl # - attempting to get useful AUTH logging (default is 9)
 define(`confMILTER_LOG_LEVEL',`9')dnl # ...without creating unnecessary milter noise


But I don't think your error is related to the SAN wildcard problem.
Looks like you are trying to verify the peer certificate?


Bjørn