ifelse(SECTION, `MAIN', `dnl

ifdef(`confSTARTTLS_SKIP_USING', `ifelse(confSTARTTLS_SKIP_USING, `NO', `dnl', `dnl
hostlist skip_tls_using		= <; +ignore_defer ; +ignore_unknown ; CONFDIR/skip_tls_using
')')

define(`confSTARTTLS_ADVERTIZE_HOSTS', `*')dnl
ifdef(`confSTARTTLS_SKIP_ADVERTIZE', `ifelse(confSTARTTLS_SKIP_ADVERTIZE, `NO', `dnl', `dnl
hostlist skip_tls_advertise	= <; +ignore_defer ; +ignore_unknown ; CONFDIR/skip_tls_advertise
define(`confSTARTTLS_ADVERTIZE_HOSTS', `!+skip_tls_advertise : *')dnl
')')
tls_advertise_hosts = confSTARTTLS_ADVERTIZE_HOSTS
tls_certificate = confTLS_CERTIFICATE
tls_privatekey = confTLS_PRIVATEKEY

') dnl ifelse(SECTION, `MAIN', `')


ifelse(SECTION, `ACL_CHECK_RCPT', `dnl

ifdef(`confTLS_ENFORCE_SUBMIT', `ifelse(confTLS_ENFORCE_SUBMIT, `NO', `dnl', `dnl
	deny	condition	= ${if ={$received_port}{587}{yes}{no}}
ifelse(confTLS_ENFORCE_SUBMIT, `EXTERNAL', `dnl
		! hosts		= confTLS_ENFORCE_SUBMIT_SKIP_HOSTS
') dnl ifelse(confTLS_ENFORCE_SUBMIT, `EXTERNAL', `')
		! encrypted	= *
		message		= You must use STARTTLS first (received port: $received_port)
')') dnl ifdef(`confTLS_ENFORCE_SUBMIT', `ifelse(confTLS_ENFORCE_SUBMIT, `NO', `dnl', `dnl')')

') dnl ifelse(SECTION, `ACL_CHECK_RCPT', `')