OpenSSL 1.1 compatibility

This adds compatibility for OpenSSL 1.1

Since renegotiation is removed from TLS 1.3 we also removed support for
authentication via client certificates (control/tlsclients). In general
this is still supported by TLS 1.3 however I'm just lazy and we don't
need this feature anyway.

This also adds optional support for OpenSSL configuration commands for
qmail-smtpd and qmail-remote. Commands are loaded from control/opensslconf.
For a list of supported commands see
https://www.openssl.org/docs/man1.0.2/ssl/SSL_CONF_cmd.html#SUPPORTED-CONFIGURATION-FILE-COMMANDS

1 files changed, 0 insertions, 10 deletions

diff --git a/README.starttls b/README.starttls
index 07ee275..6168c6d 100644
--- a/README.starttls
+++ b/README.starttls
@@ -42,16 +42,6 @@ Optional: - when DEBUG is defined, some extra TLS info will be logged
             an exhaustive list of hosts TLS is tried on.
             If /var/qmail/control/notlshosts/host.dom.ain is present,
             no TLS is tried on this host.
-          - client authentication:
-            when relay rules would reject an incoming mail, 
-            qmail-smtpd can allow the mail based on a presented cert.
-            Certs are verified against a CA list in 
-            /var/qmail/control/clientca.pem (eg. http://www.modssl.org/
-            source/cvs/exp/mod_ssl/pkg.mod_ssl/pkg.sslcfg/ca-bundle.crt)
-            and the cert email-address has to match a line in
-            /var/qmail/control/tlsclients. This email-address is logged
-            in the headers. CRLs can be provided through 
-            /var/qmail/control/clientcrl.pem.
           - cipher selection:
             qmail-remote: 
               openssl cipher string (`man ciphers`) read from