diff -Naur postfix-2.3-20051014-vanilla/proto/TLS_README.html postfix-2.3-20051014/proto/TLS_README.html --- postfix-2.3-20051014-vanilla/proto/TLS_README.html 2005-08-31 02:58:05.000000000 +0200 +++ postfix-2.3-20051014/proto/TLS_README.html 2005-10-24 20:07:10.000000000 +0200 @@ -262,7 +262,7 @@ certificates issued by these CAs, append the root certificate to $smtpd_tls_CAfile or install it in the $smtpd_tls_CApath directory. When you configure trust in a root CA, it is not necessary to explicitly trust -intermediary CAs signed by the root CA, unless $smtpd_tls_verify_depth +intermediary CAs signed by the root CA, unless $smtpd_tls_ccert_verifydepth is less than the number of CAs in the certificate chain for the clients of interest. With a verify depth of 1 you can only verify certificates directly signed by a trusted CA, and all trusted intermediary CAs need to @@ -315,7 +315,7 @@ accessible inside the optional chroot jail.

When you configure Postfix to request client certificates (by -setting $smtpd_tls_asck_ccert = yes), any certificates in +setting $smtpd_tls_ask_ccert = yes), any certificates in $smtpd_tls_CAfile are sent to the client, in order to allow it to choose an identity signed by a CA you trust. If no $smtpd_tls_CAfile is specified, no preferred CA list is sent, and the client is free