interimap/tests/tls-verify-peer, branch master

tests: Use "openssl rehash" instead of c_rehash

2025-10-07T17:23:15+00:00

The built-in version of c_rehash is "openssl rehash" and is available since the
3.0 series. The c_rehash is a perl script which is considered legacy.

Switch to "openssl rehash"

Signed-off-by: Sebastian Andrzej Siewior

Port tests and documentation to Dovecot 2.4.

2025-04-26T16:03:03+00:00

See https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html .

tests/*/t: Explicitly pass `-in /dev/stdin` to openssl(1).

2024-03-06T14:09:05+00:00

tests/*/t: Replace filetype=sh with filetype=bash.

2024-03-06T13:36:38+00:00

libinterimap: use default locations for trusted CA certificates when neither CAfile nor CApath are set.

2020-12-13T17:44:18+00:00

In particular, OpenSSL's default locations can be overridden by the
SSL_CERT_FILE resp. SSL_CERT_DIR environment variables, see
SSL_CTX_load_verify_locations(3ssl).

This bumps the minimum OpenSSL version to 1.1.0 (when SSL_verify is
used).

test suite: ensure we haven't started speaking IMAP when the SSL/TLS handshake is aborted.

2020-12-13T16:38:07+00:00

(Unless STARTTLS is used to upgrade the connection.)

test suite: supply our own OpenSSL configuration file with MinProtocol=None.

2020-12-11T17:44:13+00:00

So we can test TLSv1 as well, not just TLSv1.2 and later.

Also, explicitly set ssl_min_protocol=TLSv1 in the Dovecot configuration
file (the default as of 2.3.11.3), hence running TLS tests now require
Dovecot 2.3 or later.

libinterimap: make SSL_verify check the hostname as well.

2020-12-11T10:20:41+00:00

More precisely, ensure that the certificate Subject Alternative Name
(SAN) or Subject CommonName (CN) matches the hostname or IP literal
specified by the 'host' option.  Previously it was only verifying the
chain of trust.

This bumps the minimum Net::SSLeay version to 1.83 and OpenSSL version
1.0.2.

test suite: always generate new certificates on `make test`.

2020-12-11T10:20:41+00:00

In addition, sign test certificates with the same root CA.  Hence
running `make test` now requires OpenSSL 1.1.1 or later.

libinterimap: show the matching pinned SPKI in --debug mode.

2020-12-11T10:20:37+00:00