X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/5e865707737f1985030196dbefa67690221a494e..94c82143038ad02b0d0b7f8607d0b432c4831fe2:/cookbooks/exim/templates/default/exim4.conf.erb?ds=sidebyside

diff --git a/cookbooks/exim/templates/default/exim4.conf.erb b/cookbooks/exim/templates/default/exim4.conf.erb
index f4db98d06..18544c091 100644
--- a/cookbooks/exim/templates/default/exim4.conf.erb
+++ b/cookbooks/exim/templates/default/exim4.conf.erb
@@ -146,14 +146,23 @@ spamd_address = 127.0.0.1 783
 
 tls_advertise_hosts = <; !127.0.0.1 ; !::1
 
+# Configured TLS cipher selection.
+
+tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%SERVER_PRECEDENCE
+
 # Specify the location of the Exim server's TLS certificate and private key.
 # The private key must not be encrypted (password protected). You can put
 # the certificate and private key in the same file, in which case you only
 # need the first setting, or in separate files, in which case you need both
 # options.
 
+<% if node[:exim][:certificate_names] -%>
+tls_certificate = /etc/ssl/certs/<%= node[:exim][:certificate_names].first %>.pem
+tls_privatekey = /etc/ssl/private/<%= node[:exim][:certificate_names].first %>.key
+<% else -%>
 tls_certificate = /etc/ssl/certs/exim.pem
 tls_privatekey = /etc/ssl/private/exim.key
+<% end -%>
 
 # In order to support roaming users who wish to send email from anywhere,
 # you may want to make Exim listen on other ports as well as port 25, in
@@ -657,6 +666,8 @@ begin transports
 
 remote_smtp:
   driver = smtp
+  multi_domain = false
+  tls_require_ciphers = <%= node[:ssl][:gnutls_ciphers] %>:%LATEST_RECORD_VERSION
 
 
 # This transport is used for handling pipe deliveries generated by alias or