Set X.509 certificate purpose to 'SSL Server' for SSL_verify=YES.

2 files changed, 3 insertions, 0 deletions

diff --git a/Changelog b/Changelog
index cf11878..820ee6f 100644
--- a/Changelog
+++ b/Changelog
@@ -25,6 +25,7 @@ interimap (0.2) upstream;
   * Don't set SO_KEEPALIVE on the socket.  This is most likely useless
     in our case since the TCP keepalive time is usually much higher than
     the IMAP timeout.
+  * Set X.509 certificate purpose to 'SSL Server' for SSL_verify=YES.
 
  -- Guilhem Moulin <guilhem@guilhem.org>  Wed, 09 Sep 2015 00:44:35 +0200
 
diff --git a/lib/Net/IMAP/InterIMAP.pm b/lib/Net/IMAP/InterIMAP.pm
index a0be91e..53fddec 100644
--- a/lib/Net/IMAP/InterIMAP.pm
+++ b/lib/Net/IMAP/InterIMAP.pm
@@ -1398,6 +1398,8 @@ sub _start_ssl($$) {
                 or $self->_ssl_error("Can't load verify locations");
         }
         Net::SSLeay::CTX_set_verify($ctx, Net::SSLeay::VERIFY_PEER());
+        Net::SSLeay::CTX_set_purpose($ctx, Net::SSLeay::X509_PURPOSE_SSL_SERVER())
+                or $self->_ssl_error("Can't set purpose");
     }
     else {
         Net::SSLeay::CTX_set_verify($ctx, Net::SSLeay::VERIFY_NONE());