Re: Client Auth certificates, threat or menace?

John Levine  wrote:

Right.  It would make sense to look for the client extension when
checking a cert
presented for SMTP AUTH, otherwise not.  Any idea whether the code does that?

What do you mean by "a cert presented for SMTP AUTH"?
Certs are handled during the TLS handshake.

      AuthMechanisms
                List of authentication mechanisms  for  AUTH
                (separated  by spaces).  The advertised list
                of authentication mechanisms will be the in-
                tersection  of  this  list  and  the list of
                available mechanisms as  determined  by  the
                Cyrus  SASL library.  If STARTTLS is active,
                EXTERNAL will be added  to  this  list.   In
                that  case,  the  value of {cert_subject} is
                used as authentication id.

If the server cannot "verify" the client cert, then obviously it
won't be used - and as explained elsewhere openssl does not allow
to verify a cert which is just for a "server".