[JAMES-3851] TLS host name verification should handle trailing dot

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: master
• Component/s: Remote Delivery
• Assignee: Unassigned
• Reporter: Karsten Otto
• Created: 10/Nov/22 13:27
• Updated: 15/Nov/22 08:48
• Resolved: 15/Nov/22 08:48

Description

I noticed that sometimes RemoteDelivery opens a connection using a fully qualified hostname that ends with a trailing dot, like "mail.example.org." I believe James may get that from MX resolving, since afaik DNS servers may do this to indicate an absolute FQDN vs. a relative one. This is not an issue when establishing a connection, but will break TLS hostname verification, since the CN and SubjectAltNames in server certificates never use trailing dots.

Consequently, RemoteDelivery should strip a trailing dot from the hostname before connecting.

Issue Links

• relates to: JAMES-3832 Support TLS host name verification
• links to: GitHub Pull Request #1304
• links to: GitHub Pull Request #1309