Prepare v0.11.8 (#985 )

ci: bump dependencies (#984 )
feat(tls-peer-certificates): Provide peer certs (#976 )
2024-09-03 15:43:04 +02:00 · 2024-09-02 17:37:44 +02:00 · 2024-09-02 17:26:46 +02:00 · 2024-08-29 05:43:23 +02:00 · 2024-08-29 05:43:14 +02:00 · 2024-08-23 09:28:21 +02:00
25 changed files with 1045 additions and 407 deletions
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,16 +13,16 @@ env:

 jobs:
  rustfmt:
-    name: rustfmt / nightly-2023-06-22
+    name: rustfmt / nightly-2024-09-01
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Install rust
        run: |
-          rustup default nightly-2023-06-22
+          rustup default nightly-2024-09-01
          rustup component add rustfmt

      - name: cargo fmt
@@ -34,7 +34,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Install rust
        run: |
@@ -50,7 +50,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Install rust
        run: rustup update --no-self-update stable
@@ -80,7 +80,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4

      - name: Install rust
        run: |
@@ -134,7 +134,7 @@ jobs:
 #    name: Coverage
 #    runs-on: ubuntu-latest
 #    steps:
-#      - uses: actions/checkout@v2
+#      - uses: actions/checkout@v4
 #      - uses: actions-rs/toolchain@v1
 #        with:
 #          toolchain: nightly
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,79 @@
+<a name="v0.11.8"></a>
+### v0.11.8 (2024-09-03)
+
+#### Features
+
+* Add mTLS support ([#974])
+* Implement `accept_invalid_hostnames` for rustls ([#977])
+* Provide certificate chain for peer certificates when using `rustls` or `boring-tls` ([#976])
+
+#### Changes
+
+* Make `HeaderName` comparisons via `PartialEq` case insensitive ([#980])
+
+#### Misc
+
+* Fix clippy warnings ([#979])
+* Replace manual impl of `#[non_exhaustive]` for `InvalidHeaderName` ([#981])
+
+[#974]: https://github.com/lettre/lettre/pull/974
+[#976]: https://github.com/lettre/lettre/pull/976
+[#977]: https://github.com/lettre/lettre/pull/977
+[#980]: https://github.com/lettre/lettre/pull/980
+[#981]: https://github.com/lettre/lettre/pull/981
+
+<a name="v0.11.7"></a>
+### v0.11.7 (2024-04-23)
+
+#### Misc
+
+* Bump `hostname` to v0.4 ([#956])
+* Fix `tracing` message consistency ([#960])
+* Bump minimum required `rustls` to v0.23.5 ([#958])
+* Dropped use of `ref` syntax in the entire project ([#959])
+
+[#956]: https://github.com/lettre/lettre/pull/956
+[#958]: https://github.com/lettre/lettre/pull/958
+[#959]: https://github.com/lettre/lettre/pull/959
+[#960]: https://github.com/lettre/lettre/pull/960
+
+<a name="v0.11.6"></a>
+### v0.11.6 (2024-03-28)
+
+#### Bug fixes
+
+* Upgraded `email-encoding` to v0.3 - fixing multiple encoding bugs in the process ([#952])
+
+#### Misc
+
+* Updated copyright year in license ([#954])
+
+[#952]: https://github.com/lettre/lettre/pull/952
+[#954]: https://github.com/lettre/lettre/pull/954
+
+<a name="v0.11.5"></a>
+### v0.11.5 (2024-03-25)
+
+#### Features
+
+* Support SMTP SASL draft login challenge ([#911])
+* Add conversion from SMTP response code to integer ([#941])
+
+#### Misc
+
+* Upgrade `rustls` to v0.23 ([#950])
+* Bump `base64` to v0.22 ([#945])
+* Fix typos in documentation ([#943], [#944])
+* Add `Cargo.lock` ([#942])
+
+[#911]: https://github.com/lettre/lettre/pull/911
+[#941]: https://github.com/lettre/lettre/pull/941
+[#942]: https://github.com/lettre/lettre/pull/942
+[#943]: https://github.com/lettre/lettre/pull/943
+[#944]: https://github.com/lettre/lettre/pull/944
+[#945]: https://github.com/lettre/lettre/pull/945
+[#950]: https://github.com/lettre/lettre/pull/950
+
 <a name="v0.11.4"></a>
 ### v0.11.4 (2024-01-28)

--- a/Cargo.lock
+++ b/Cargo.lock
@@ -634,16 +634,15 @@ dependencies = [

 [[package]]
 name = "curve25519-dalek"
-version = "4.1.2"
+version = "4.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a677b8922c94e01bdbb12126b0bc852f00447528dee1782229af9c720c3f348"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
 "cfg-if",
 "cpufeatures",
 "curve25519-dalek-derive",
 "digest",
 "fiat-crypto",
- "platforms",
 "rustc_version",
 "subtle",
 "zeroize",
@@ -688,6 +687,17 @@ dependencies = [
 "crypto-common",
 ]

+[[package]]
+name = "displaydoc"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -720,11 +730,11 @@ checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a"

 [[package]]
 name = "email-encoding"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbfb21b9878cf7a348dcb8559109aabc0ec40d69924bd706fa5149846c4fef75"
+checksum = "60d1d33cdaede7e24091f039632eb5d3c7469fe5b066a985281a34fc70fa317f"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.0",
 "memchr",
 ]

@@ -942,9 +952,9 @@ dependencies = [

 [[package]]
 name = "futures-rustls"
-version = "0.25.1"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d8a2499f0fecc0492eb3e47eab4e92da7875e1028ad2528f214ac3346ca04e"
+checksum = "a8f2f12607f92c69b12ed746fabf9ca4f5c482cba46679c1a75b874ed7c26adb"
 dependencies = [
 "futures-io",
 "rustls",
@@ -1045,13 +1055,13 @@ checksum = "bd5256b483761cd23699d0da46cc6fd2ee3be420bbe6d020ae4a091e70b7e9fd"

 [[package]]
 name = "hostname"
-version = "0.3.1"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
+checksum = "f9c7c7c8ac16c798734b8a24560c1362120597c40d5e1459f09498f8f6c8f2ba"
 dependencies = [
+ "cfg-if",
 "libc",
- "match_cfg",
- "winapi",
+ "windows",
 ]

 [[package]]
@@ -1060,6 +1070,124 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"

+[[package]]
+name = "icu_collections"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_locid_transform_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+
+[[package]]
+name = "icu_normalizer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+
+[[package]]
+name = "icu_properties"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f8ac670d7422d7f76b32e17a5db556510825b29ec9154f235977c9caba61036"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locid_transform",
+ "icu_properties_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+
+[[package]]
+name = "icu_provider"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_provider_macros",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_macros"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
 [[package]]
 name = "idna"
 version = "0.5.0"
@@ -1070,6 +1198,18 @@ dependencies = [
 "unicode-normalization",
 ]

+[[package]]
+name = "idna"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4716a3a0933a1d01c2f72450e89596eb51dd34ef3c211ccd875acdf1f8fe47ed"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+ "smallvec",
+ "utf8_iter",
+]
+
 [[package]]
 name = "instant"
 version = "0.1.12"
@@ -1151,7 +1291,7 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"

 [[package]]
 name = "lettre"
-version = "0.11.4"
+version = "0.11.8"
 dependencies = [
 "async-std",
 "async-trait",
@@ -1169,7 +1309,7 @@ dependencies = [
 "glob",
 "hostname",
 "httpdate",
- "idna",
+ "idna 1.0.0",
 "maud",
 "mime",
 "native-tls",
@@ -1181,6 +1321,7 @@ dependencies = [
 "rustls",
 "rustls-native-certs",
 "rustls-pemfile",
+ "rustls-pki-types",
 "serde",
 "serde_json",
 "sha2",
@@ -1231,6 +1372,12 @@ version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01cda141df6706de531b6c46c3a33ecca755538219bd484262fa09410c13539c"

+[[package]]
+name = "litemap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704"
+
 [[package]]
 name = "log"
 version = "0.4.20"
@@ -1240,12 +1387,6 @@ dependencies = [
 "value-bag",
 ]

-[[package]]
-name = "match_cfg"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
-
 [[package]]
 name = "maud"
 version = "0.26.0"
@@ -1424,9 +1565,9 @@ checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"

 [[package]]
 name = "openssl"
-version = "0.10.63"
+version = "0.10.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15c9d69dd87a29568d4d017cfe8ec518706046a05184e5aea92d0af890b803c8"
+checksum = "9529f4786b70a3e8c61e11179af17ab6188ad8d0ded78c5529441ed39d4bd9c1"
 dependencies = [
 "bitflags 2.4.2",
 "cfg-if",
@@ -1456,9 +1597,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"

 [[package]]
 name = "openssl-sys"
-version = "0.9.99"
+version = "0.9.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e1bf214306098e4832460f797824c05d25aacdf896f64a985fb0fd992454ae"
+checksum = "7f9e8deee91df40a943c71b917e5874b951d32a802526c85721ce3b776c929d6"
 dependencies = [
 "cc",
 "libc",
@@ -1549,12 +1690,6 @@ version = "0.3.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"

-[[package]]
-name = "platforms"
-version = "3.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "626dec3cac7cc0e1577a2ec3fc496277ec2baa084bebad95bb6fdbfae235f84c"
-
 [[package]]
 name = "plotters"
 version = "0.3.5"
@@ -1847,11 +1982,12 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.22.2"
+version = "0.23.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41"
+checksum = "afabcee0551bd1aa3e18e5adbf2c0544722014b899adb31bd186ec638d3da97e"
 dependencies = [
 "log",
+ "once_cell",
 "ring",
 "rustls-pki-types",
 "rustls-webpki",
@@ -1884,9 +2020,9 @@ dependencies = [

 [[package]]
 name = "rustls-pki-types"
-version = "1.3.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "048a63e5b3ac996d78d402940b5fa47973d2d080c6c6fffa1d0f19c4445310b7"
+checksum = "976295e77ce332211c0d24d92c0e83e50f5c5f046d11082cea19f3df13a3562d"

 [[package]]
 name = "rustls-webpki"
@@ -2085,6 +2221,12 @@ dependencies = [
 "der",
 ]

+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
 [[package]]
 name = "stacker"
 version = "0.1.15"
@@ -2126,6 +2268,17 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "synstructure"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.10.0"
@@ -2148,6 +2301,16 @@ dependencies = [
 "once_cell",
 ]

+[[package]]
+name = "tinystr"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "tinytemplate"
 version = "1.2.1"
@@ -2226,9 +2389,9 @@ dependencies = [

 [[package]]
 name = "tokio-rustls"
-version = "0.25.0"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
+checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
 dependencies = [
 "rustls",
 "rustls-pki-types",
@@ -2320,10 +2483,22 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "31e6302e3bb753d46e83516cae55ae196fc0c309407cf11ab35cc51a4c2a4633"
 dependencies = [
 "form_urlencoded",
- "idna",
+ "idna 0.5.0",
 "percent-encoding",
 ]

+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "uuid"
 version = "1.7.0"
@@ -2495,6 +2670,25 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

+[[package]]
+name = "windows"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48a53791691ab099e5e2ad123536d0fff50652600abaf43bbf952894110d0be"
+dependencies = [
+ "windows-core",
+ "windows-targets 0.52.0",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets 0.52.0",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -2627,12 +2821,48 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dff9641d1cd4be8d1a070daf9e3773c5f67e78b4d9d42263020c057706765c04"

+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+
 [[package]]
 name = "yansi"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"

+[[package]]
+name = "yoke"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+ "synstructure",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.7.32"
@@ -2653,8 +2883,51 @@ dependencies = [
 "syn 2.0.48",
 ]

+[[package]]
+name = "zerofrom"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+ "synstructure",
+]
+
 [[package]]
 name = "zeroize"
 version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
+
+[[package]]
+name = "zerovec"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.48",
+]
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "lettre"
 # remember to update html_root_url and README.md (Cargo.toml example and deps.rs badge)
-version = "0.11.4"
+version = "0.11.8"
 description = "Email client"
 readme = "README.md"
 homepage = "https://lettre.rs"
@@ -20,7 +20,7 @@ maintenance = { status = "actively-developed" }

 [dependencies]
 chumsky = "0.9"
-idna = "0.5"
+idna = "1"
 tracing = { version = "0.1.16", default-features = false, features = ["std"], optional = true } # feature

 # builder
@@ -29,7 +29,7 @@ mime = { version = "0.3.4", optional = true }
 fastrand = { version = "2.0", optional = true }
 quoted_printable = { version = "0.5", optional = true }
 base64 = { version = "0.22", optional = true }
-email-encoding = { version = "0.2", optional = true }
+email-encoding = { version = "0.3", optional = true }

 # file transport
 uuid = { version = "1", features = ["v4"], optional = true }
@@ -38,16 +38,17 @@ serde_json = { version = "1", optional = true }

 # smtp-transport
 nom = { version = "7", optional = true }
-hostname = { version = "0.3", optional = true } # feature
+hostname = { version = "0.4", optional = true } # feature
 socket2 = { version = "0.5.1", optional = true }
 url = { version = "2.4", optional = true }
 percent-encoding = { version = "2.3", optional = true }

 ## tls
 native-tls = { version = "0.2.5", optional = true } # feature
-rustls = { version = "0.22.1", optional = true }
+rustls = { version = "0.23.5", default-features = false, features = ["ring", "logging", "std", "tls12"], optional = true }
 rustls-pemfile = { version = "2", optional = true }
 rustls-native-certs = { version = "0.7", optional = true }
+rustls-pki-types = { version = "1.7", optional = true }
 webpki-roots = { version = "0.26", optional = true }
 boring = { version = "4", optional = true }

@@ -58,13 +59,12 @@ async-trait = { version = "0.1", optional = true }

 ## async-std
 async-std = { version = "1.8", optional = true }
-#async-native-tls = { version = "0.3.3", optional = true }
-futures-rustls = { version = "0.25", optional = true }
+futures-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"], optional = true }

 ## tokio
 tokio1_crate = { package = "tokio", version = "1", optional = true }
 tokio1_native_tls_crate = { package = "tokio-native-tls", version = "0.3", optional = true }
-tokio1_rustls = { package = "tokio-rustls", version = "0.25", optional = true }
+tokio1_rustls = { package = "tokio-rustls", version = "0.26", default-features = false, features = ["logging", "tls12", "ring"], optional = true }
 tokio1_boring = { package = "tokio-boring", version = "4", optional = true }

 ## dkim
@@ -108,13 +108,12 @@ smtp-transport = ["dep:base64", "dep:nom", "dep:socket2", "dep:url", "dep:percen

 pool = ["dep:futures-util"]

-rustls-tls = ["dep:webpki-roots", "dep:rustls", "dep:rustls-pemfile"]
+rustls-tls = ["dep:webpki-roots", "dep:rustls", "dep:rustls-pemfile", "dep:rustls-pki-types"]

 boring-tls = ["dep:boring"]

 # async
 async-std1 = ["dep:async-std", "dep:async-trait", "dep:futures-io", "dep:futures-util"]
-#async-std1-native-tls = ["async-std1", "native-tls", "dep:async-native-tls"]
 async-std1-rustls-tls = ["async-std1", "rustls-tls", "dep:futures-rustls"]
 tokio1 = ["dep:tokio1_crate", "dep:async-trait", "dep:futures-io", "dep:futures-util"]
 tokio1-native-tls = ["tokio1", "native-tls", "dep:tokio1_native_tls_crate"]
@@ -123,6 +122,9 @@ tokio1-boring-tls = ["tokio1", "boring-tls", "dep:tokio1_boring"]

 dkim = ["dep:base64", "dep:sha2", "dep:rsa", "dep:ed25519-dalek"]

+[lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(lettre_ignore_tls_mismatch)'] }
+
 [package.metadata.docs.rs]
 all-features = true
 rustdoc-args = ["--cfg", "docsrs", "--cfg", "lettre_ignore_tls_mismatch"]
--- a/4
+++ b/4
@@ -1,5 +1,5 @@
-Copyright (c) 2014-2022 Alexis Mousset <contact@amousset.me>
-Copyright (c) 2019-2022 Paolo Barbolini <paolo@paolo565.org>
+Copyright (c) 2014-2024 Alexis Mousset <contact@amousset.me>
+Copyright (c) 2019-2024 Paolo Barbolini <paolo@paolo565.org>
 Copyright (c) 2018 K. <kayo@illumium.org>

 Permission is hereby granted, free of charge, to any
--- a/README.md
+++ b/README.md
@@ -28,8 +28,8 @@
 </div>

 <div align="center">
-  <a href="https://deps.rs/crate/lettre/0.11.4">
-    <img src="https://deps.rs/crate/lettre/0.11.4/status.svg"
+  <a href="https://deps.rs/crate/lettre/0.11.8">
+    <img src="https://deps.rs/crate/lettre/0.11.8/status.svg"
      alt="dependency status" />
  </a>
 </div>
--- a/examples/autoconfigure.rs
+++ b/examples/autoconfigure.rs
@@ -41,7 +41,7 @@ fn main() {

    // Plaintext connection which MUST then successfully upgrade to TLS via STARTTLS
    {
-        tracing::info!("Trying to establish a plaintext connection to {} and then updating it via the SMTP STARTTLS extension", smtp_host);
+        tracing::info!("Trying to establish a plaintext connection to {} and then upgrading it via the SMTP STARTTLS extension", smtp_host);

        let transport = SmtpTransport::starttls_relay(&smtp_host)
            .expect("build SmtpTransport::starttls_relay")
--- a/src/address/envelope.rs
+++ b/src/address/envelope.rs
@@ -14,11 +14,71 @@ pub struct Envelope {
    /// The envelope recipient's addresses
    ///
    /// This can not be empty.
+    #[cfg_attr(
+        feature = "serde",
+        serde(deserialize_with = "serde_forward_path::deserialize")
+    )]
    forward_path: Vec<Address>,
    /// The envelope sender address
    reverse_path: Option<Address>,
 }

+/// just like the default implementation to deserialize `Vec<Address>` but it
+/// forbids **de**serializing empty lists
+#[cfg(feature = "serde")]
+mod serde_forward_path {
+    use super::Address;
+    /// dummy type required for serde
+    /// see example: https://serde.rs/deserialize-map.html
+    struct CustomVisitor;
+    impl<'de> serde::de::Visitor<'de> for CustomVisitor {
+        type Value = Vec<Address>;
+
+        fn expecting(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            formatter.write_str("a non-empty list of recipient addresses")
+        }
+
+        fn visit_seq<S>(self, mut access: S) -> Result<Self::Value, S::Error>
+        where
+            S: serde::de::SeqAccess<'de>,
+        {
+            let mut seq: Vec<Address> = Vec::with_capacity(access.size_hint().unwrap_or(0));
+            while let Some(key) = access.next_element()? {
+                seq.push(key);
+            }
+            if seq.is_empty() {
+                Err(serde::de::Error::invalid_length(seq.len(), &self))
+            } else {
+                Ok(seq)
+            }
+        }
+    }
+    pub fn deserialize<'de, D>(deserializer: D) -> Result<Vec<Address>, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_seq(CustomVisitor {})
+    }
+
+    #[cfg(test)]
+    mod tests {
+        #[test]
+        fn deserializing_empty_recipient_list_returns_error() {
+            assert!(
+                serde_json::from_str::<crate::address::Envelope>(r#"{"forward_path": []}"#)
+                    .is_err()
+            );
+        }
+        #[test]
+        fn deserializing_non_empty_recipient_list_is_ok() {
+            serde_json::from_str::<crate::address::Envelope>(
+                r#"{ "forward_path": [ {"user":"foo", "domain":"example.com"} ] }"#,
+            )
+            .unwrap();
+        }
+    }
+}
+
 impl Envelope {
    /// Creates a new envelope, which may fail if `to` is empty.
    ///
--- a/src/executor.rs
+++ b/src/executor.rs
@@ -151,11 +151,11 @@ impl Executor for Tokio1Executor {
        match tls {
            Tls::Opportunistic(tls_parameters) => {
                if conn.can_starttls() {
-                    conn = conn.starttls(tls_parameters.clone(), hello_name).await?;
+                    conn.starttls(tls_parameters.clone(), hello_name).await?;
                }
            }
            Tls::Required(tls_parameters) => {
-                conn = conn.starttls(tls_parameters.clone(), hello_name).await?;
+                conn.starttls(tls_parameters.clone(), hello_name).await?;
            }
            _ => (),
        }
@@ -230,7 +230,7 @@ impl Executor for AsyncStd1Executor {
    ) -> Result<AsyncSmtpConnection, Error> {
        #[allow(clippy::match_single_binding)]
        let tls_parameters = match tls {
-            #[cfg(any(feature = "async-std1-native-tls", feature = "async-std1-rustls-tls"))]
+            #[cfg(feature = "async-std1-rustls-tls")]
            Tls::Wrapper(tls_parameters) => Some(tls_parameters.clone()),
            _ => None,
        };
@@ -243,15 +243,15 @@ impl Executor for AsyncStd1Executor {
        )
        .await?;

-        #[cfg(any(feature = "async-std1-native-tls", feature = "async-std1-rustls-tls"))]
+        #[cfg(feature = "async-std1-rustls-tls")]
        match tls {
            Tls::Opportunistic(tls_parameters) => {
                if conn.can_starttls() {
-                    conn = conn.starttls(tls_parameters.clone(), hello_name).await?;
+                    conn.starttls(tls_parameters.clone(), hello_name).await?;
                }
            }
            Tls::Required(tls_parameters) => {
-                conn = conn.starttls(tls_parameters.clone(), hello_name).await?;
+                conn.starttls(tls_parameters.clone(), hello_name).await?;
            }
            _ => (),
        }
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -109,7 +109,7 @@
 //! [mime 0.3]: https://docs.rs/mime/0.3
 //! [DKIM]: https://datatracker.ietf.org/doc/html/rfc6376

-#![doc(html_root_url = "https://docs.rs/crate/lettre/0.11.4")]
+#![doc(html_root_url = "https://docs.rs/crate/lettre/0.11.8")]
 #![doc(html_favicon_url = "https://lettre.rs/favicon.ico")]
 #![doc(html_logo_url = "https://avatars0.githubusercontent.com/u/15113230?v=4")]
 #![forbid(unsafe_code)]
@@ -174,21 +174,7 @@ mod compiletime_checks {
    If you'd like to use `boring-tls` make sure that the `rustls-tls` feature hasn't been enabled by mistake.
    Make sure to apply the same to any of your crate dependencies that use the `lettre` crate.");

-    /*
-    #[cfg(all(
-        feature = "async-std1",
-        feature = "native-tls",
-        not(feature = "async-std1-native-tls")
-    ))]
-    compile_error!("Lettre is being built with the `async-std1` and the `native-tls` features, but the `async-std1-native-tls` feature hasn't been turned on.
-    If you'd like to use rustls make sure that the `native-tls` hasn't been enabled by mistake (you may need to import lettre without default features)
-    If you're building a library which depends on lettre import it without default features and enable just the features you need.");
-    */
-    #[cfg(all(
-        feature = "async-std1",
-        feature = "native-tls",
-        not(feature = "async-std1-native-tls")
-    ))]
+    #[cfg(all(feature = "async-std1", feature = "native-tls",))]
    compile_error!("Lettre is being built with the `async-std1` and the `native-tls` features, but the async-std integration doesn't support native-tls yet.
 If you'd like to work on the issue please take a look at https://github.com/lettre/lettre/issues/576.
 If you were trying to opt into `rustls-tls` and did not activate `native-tls`, disable the default-features of lettre in `Cargo.toml` and manually add the required features.
--- a/src/message/header/content_disposition.rs
+++ b/src/message/header/content_disposition.rs
@@ -1,6 +1,6 @@
 use std::fmt::Write;

-use email_encoding::headers::EmailWriter;
+use email_encoding::headers::writer::EmailWriter;

 use super::{Header, HeaderName, HeaderValue};
 use crate::BoxError;
@@ -38,10 +38,10 @@ impl ContentDisposition {
        let mut encoded_value = String::new();
        let line_len = "Content-Disposition: ".len();
        {
-            let mut w = EmailWriter::new(&mut encoded_value, line_len, 0, false, false);
+            let mut w = EmailWriter::new(&mut encoded_value, line_len, 0, false);
            w.write_str(kind).expect("writing `kind` returned an error");
            w.write_char(';').expect("writing `;` returned an error");
-            w.optional_breakpoint();
+            w.space();

            email_encoding::headers::rfc2231::encode("filename", file_name, &mut w)
                .expect("some Write implementation returned an error");
--- a/src/message/header/mailbox.rs
+++ b/src/message/header/mailbox.rs
@@ -1,4 +1,4 @@
-use email_encoding::headers::EmailWriter;
+use email_encoding::headers::writer::EmailWriter;

 use super::{Header, HeaderName, HeaderValue};
 use crate::{
@@ -31,7 +31,7 @@ macro_rules! mailbox_header {
                let mut encoded_value = String::new();
                let line_len = $header_name.len() + ": ".len();
                {
-                    let mut w = EmailWriter::new(&mut encoded_value, line_len, 0, false, false);
+                    let mut w = EmailWriter::new(&mut encoded_value, line_len, 0, false);
                    self.0.encode(&mut w).expect("writing `Mailbox` returned an error");
                }

@@ -81,7 +81,7 @@ macro_rules! mailboxes_header {
                let mut encoded_value = String::new();
                let line_len = $header_name.len() + ": ".len();
                {
-                    let mut w = EmailWriter::new(&mut encoded_value, line_len, 0, false, false);
+                    let mut w = EmailWriter::new(&mut encoded_value, line_len, 0, false);
                    self.0.encode(&mut w).expect("writing `Mailboxes` returned an error");
                }

--- a/src/message/header/mod.rs
+++ b/src/message/header/mod.rs
@@ -7,7 +7,7 @@ use std::{
    ops::Deref,
 };

-use email_encoding::headers::EmailWriter;
+use email_encoding::headers::writer::EmailWriter;

 pub use self::{
    content::*,
@@ -124,22 +124,18 @@ impl Headers {
    }

    pub(crate) fn find_header(&self, name: &str) -> Option<&HeaderValue> {
-        self.headers
-            .iter()
-            .find(|value| name.eq_ignore_ascii_case(&value.name))
+        self.headers.iter().find(|value| name == value.name)
    }

    fn find_header_mut(&mut self, name: &str) -> Option<&mut HeaderValue> {
-        self.headers
-            .iter_mut()
-            .find(|value| name.eq_ignore_ascii_case(&value.name))
+        self.headers.iter_mut().find(|value| name == value.name)
    }

    fn find_header_index(&self, name: &str) -> Option<usize> {
        self.headers
            .iter()
            .enumerate()
-            .find(|(_i, value)| name.eq_ignore_ascii_case(&value.name))
+            .find(|(_i, value)| name == value.name)
            .map(|(i, _)| i)
    }
 }
@@ -161,18 +157,9 @@ impl Display for Headers {
 /// A possible error when converting a `HeaderName` from another type.
 // comes from `http` crate
 #[allow(missing_copy_implementations)]
-#[derive(Clone)]
-pub struct InvalidHeaderName {
-    _priv: (),
-}
-
-impl fmt::Debug for InvalidHeaderName {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("InvalidHeaderName")
-            // skip _priv noise
-            .finish()
-    }
-}
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct InvalidHeaderName;

 impl fmt::Display for InvalidHeaderName {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
@@ -189,14 +176,11 @@ pub struct HeaderName(Cow<'static, str>);
 impl HeaderName {
    /// Creates a new header name
    pub fn new_from_ascii(ascii: String) -> Result<Self, InvalidHeaderName> {
-        if !ascii.is_empty()
-            && ascii.len() <= 76
-            && ascii.is_ascii()
-            && !ascii.contains(|c| c == ':' || c == ' ')
+        if !ascii.is_empty() && ascii.len() <= 76 && ascii.is_ascii() && !ascii.contains([':', ' '])
        {
            Ok(Self(Cow::Owned(ascii)))
        } else {
-            Err(InvalidHeaderName { _priv: () })
+            Err(InvalidHeaderName)
        }
    }

@@ -257,23 +241,19 @@ impl AsRef<str> for HeaderName {

 impl PartialEq<HeaderName> for HeaderName {
    fn eq(&self, other: &HeaderName) -> bool {
-        let s1: &str = self.as_ref();
-        let s2: &str = other.as_ref();
-        s1 == s2
+        self.eq_ignore_ascii_case(other)
    }
 }

 impl PartialEq<&str> for HeaderName {
    fn eq(&self, other: &&str) -> bool {
-        let s: &str = self.as_ref();
-        s == *other
+        self.eq_ignore_ascii_case(other)
    }
 }

 impl PartialEq<HeaderName> for &str {
    fn eq(&self, other: &HeaderName) -> bool {
-        let s: &str = other.as_ref();
-        *self == s
+        self.eq_ignore_ascii_case(other)
    }
 }

@@ -348,7 +328,7 @@ impl<'a> HeaderValueEncoder<'a> {

    fn new(name: &str, writer: &'a mut dyn Write) -> Self {
        let line_len = name.len() + ": ".len();
-        let writer = EmailWriter::new(writer, line_len, 0, false, false);
+        let writer = EmailWriter::new(writer, line_len, 0, false);

        Self {
            writer,
@@ -467,6 +447,60 @@ mod tests {
        let _ = HeaderName::new_from_ascii_str("");
    }

+    #[test]
+    fn headername_headername_eq() {
+        assert_eq!(
+            HeaderName::new_from_ascii_str("From"),
+            HeaderName::new_from_ascii_str("From")
+        );
+    }
+
+    #[test]
+    fn headername_str_eq() {
+        assert_eq!(HeaderName::new_from_ascii_str("From"), "From");
+    }
+
+    #[test]
+    fn str_headername_eq() {
+        assert_eq!("From", HeaderName::new_from_ascii_str("From"));
+    }
+
+    #[test]
+    fn headername_headername_eq_case_insensitive() {
+        assert_eq!(
+            HeaderName::new_from_ascii_str("From"),
+            HeaderName::new_from_ascii_str("from")
+        );
+    }
+
+    #[test]
+    fn headername_str_eq_case_insensitive() {
+        assert_eq!(HeaderName::new_from_ascii_str("From"), "from");
+    }
+
+    #[test]
+    fn str_headername_eq_case_insensitive() {
+        assert_eq!("from", HeaderName::new_from_ascii_str("From"));
+    }
+
+    #[test]
+    fn headername_headername_ne() {
+        assert_ne!(
+            HeaderName::new_from_ascii_str("From"),
+            HeaderName::new_from_ascii_str("To")
+        );
+    }
+
+    #[test]
+    fn headername_str_ne() {
+        assert_ne!(HeaderName::new_from_ascii_str("From"), "To");
+    }
+
+    #[test]
+    fn str_headername_ne() {
+        assert_ne!("From", HeaderName::new_from_ascii_str("To"));
+    }
+
    // names taken randomly from https://it.wikipedia.org/wiki/Pinco_Pallino

    #[test]
@@ -612,17 +646,14 @@ mod tests {
            "🌍 <world@example.com>, 🦆 Everywhere <ducks@example.com>, Иванов Иван Иванович <ivanov@example.com>, Jānis Bērziņš <janis@example.com>, Seán Ó Rudaí <sean@example.com>".to_owned(),
        ));

-        // TODO: fix the fact that the encoder doesn't know that
-        // the space between the name and the address should be
-        // removed when wrapping.
        assert_eq!(
            headers.to_string(),
            concat!(
                "To: =?utf-8?b?8J+MjQ==?= <world@example.com>, =?utf-8?b?8J+mhg==?=\r\n",
                " Everywhere <ducks@example.com>, =?utf-8?b?0JjQstCw0L3QvtCyINCY0LLQsNC9?=\r\n",
                " =?utf-8?b?INCY0LLQsNC90L7QstC40Yc=?= <ivanov@example.com>,\r\n",
-                "  =?utf-8?b?SsSBbmlzIELEk3J6acWGxaE=?= <janis@example.com>,\r\n",
-                "  =?utf-8?b?U2XDoW4gw5MgUnVkYcOt?= <sean@example.com>\r\n",
+                " =?utf-8?b?SsSBbmlzIELEk3J6acWGxaE=?= <janis@example.com>, =?utf-8?b?U2U=?=\r\n",
+                " =?utf-8?b?w6FuIMOTIFJ1ZGHDrQ==?= <sean@example.com>\r\n",
            )
        );
    }
@@ -687,9 +718,6 @@ mod tests {
            "quoted-printable".to_owned(),
        ));

-        // TODO: fix the fact that the encoder doesn't know that
-        // the space between the name and the address should be
-        // removed when wrapping.
        assert_eq!(
            headers.to_string(),
            concat!(
@@ -699,8 +727,8 @@ mod tests {
                "To: =?utf-8?b?8J+MjQ==?= <world@example.com>, =?utf-8?b?8J+mhg==?=\r\n",
                " Everywhere <ducks@example.com>, =?utf-8?b?0JjQstCw0L3QvtCyINCY0LLQsNC9?=\r\n",
                " =?utf-8?b?INCY0LLQsNC90L7QstC40Yc=?= <ivanov@example.com>,\r\n",
-                "  =?utf-8?b?SsSBbmlzIELEk3J6acWGxaE=?= <janis@example.com>,\r\n",
-                "  =?utf-8?b?U2XDoW4gw5MgUnVkYcOt?= <sean@example.com>\r\n",
+                " =?utf-8?b?SsSBbmlzIELEk3J6acWGxaE=?= <janis@example.com>, =?utf-8?b?U2U=?=\r\n",
+                " =?utf-8?b?w6FuIMOTIFJ1ZGHDrQ==?= <sean@example.com>\r\n",
                "From: Someone <somewhere@example.com>\r\n",
                "Content-Transfer-Encoding: quoted-printable\r\n",
            )
--- a/src/message/mailbox/types.rs
+++ b/src/message/mailbox/types.rs
@@ -6,7 +6,7 @@ use std::{
 };

 use chumsky::prelude::*;
-use email_encoding::headers::EmailWriter;
+use email_encoding::headers::writer::EmailWriter;

 use super::parsers;
 use crate::address::{Address, AddressError};
@@ -72,7 +72,7 @@ impl Mailbox {
    pub(crate) fn encode(&self, w: &mut EmailWriter<'_>) -> FmtResult {
        if let Some(name) = &self.name {
            email_encoding::headers::quoted_string::encode(name, w)?;
-            w.optional_breakpoint();
+            w.space();
            w.write_char('<')?;
        }

@@ -261,7 +261,7 @@ impl Mailboxes {
        for mailbox in self.iter() {
            if !mem::take(&mut first) {
                w.write_char(',')?;
-                w.optional_breakpoint();
+                w.space();
            }

            mailbox.encode(w)?;
@@ -444,8 +444,6 @@ fn write_quoted_string_char(f: &mut Formatter<'_>, c: char) -> FmtResult {

 #[cfg(test)]
 mod test {
-    use std::convert::TryInto;
-
    use pretty_assertions::assert_eq;

    use super::Mailbox;
--- a/src/message/mimebody.rs
+++ b/src/message/mimebody.rs
@@ -420,7 +420,6 @@ mod test {
    use pretty_assertions::assert_eq;

    use super::*;
-    use crate::message::header;

    #[test]
    fn single_part_binary() {
--- a/src/transport/mod.rs
+++ b/src/transport/mod.rs
@@ -12,7 +12,7 @@
 //!
 //! * a service from your Cloud or hosting provider
 //! * an email server ([MTA] for Mail Transfer Agent, like Postfix or Exchange), running either
-//! locally on your servers or accessible over the network
+//!   locally on your servers or accessible over the network
 //! * a dedicated external service, like Mailchimp, Mailgun, etc.
 //!
 //! In most cases, the best option is to:
--- a/src/transport/smtp/async_transport.rs
+++ b/src/transport/smtp/async_transport.rs
@@ -82,7 +82,6 @@ where
    #[cfg(any(
        feature = "tokio1-native-tls",
        feature = "tokio1-rustls-tls",
-        feature = "async-std1-native-tls",
        feature = "async-std1-rustls-tls"
    ))]
    #[cfg_attr(
@@ -117,7 +116,6 @@ where
    #[cfg(any(
        feature = "tokio1-native-tls",
        feature = "tokio1-rustls-tls",
-        feature = "async-std1-native-tls",
        feature = "async-std1-rustls-tls"
    ))]
    #[cfg_attr(
@@ -353,7 +351,6 @@ impl AsyncSmtpTransportBuilder {
    #[cfg(any(
        feature = "tokio1-native-tls",
        feature = "tokio1-rustls-tls",
-        feature = "async-std1-native-tls",
        feature = "async-std1-rustls-tls"
    ))]
    #[cfg_attr(
--- a/src/transport/smtp/client/async_connection.rs
+++ b/src/transport/smtp/client/async_connection.rs
@@ -6,7 +6,7 @@ use futures_util::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use super::async_net::AsyncTokioStream;
 #[cfg(feature = "tracing")]
 use super::escape_crlf;
-use super::{AsyncNetworkStream, ClientCodec, ConnectionState, TlsParameters};
+use super::{AsyncNetworkStream, ClientCodec, TlsParameters};
 use crate::{
    transport::smtp::{
        authentication::{Credentials, Mechanism},
@@ -19,11 +19,25 @@ use crate::{
    Envelope,
 };

+macro_rules! try_smtp (
+    ($err: expr, $client: ident) => ({
+        match $err {
+            Ok(val) => val,
+            Err(err) => {
+                $client.abort().await;
+                return Err(From::from(err))
+            },
+        }
+    })
+);
+
 /// Structure that implements the SMTP client
 pub struct AsyncSmtpConnection {
    /// TCP stream between client and server
    /// Value is None before connection
    stream: BufReader<AsyncNetworkStream>,
+    /// Panic state
+    panic: bool,
    /// Information about the server
    server_info: ServerInfo,
 }
@@ -112,6 +126,7 @@ impl AsyncSmtpConnection {
        let stream = BufReader::new(stream);
        let mut conn = AsyncSmtpConnection {
            stream,
+            panic: false,
            server_info: ServerInfo::default(),
        };
        // TODO log
@@ -155,26 +170,30 @@ impl AsyncSmtpConnection {
            mail_options.push(MailParameter::Body(MailBodyParameter::EightBitMime));
        }

-        self.command(Mail::new(envelope.from().cloned(), mail_options))
-            .await?;
+        try_smtp!(
+            self.command(Mail::new(envelope.from().cloned(), mail_options))
+                .await,
+            self
+        );

        // Recipient
        for to_address in envelope.to() {
-            self.command(Rcpt::new(to_address.clone(), vec![])).await?;
+            try_smtp!(
+                self.command(Rcpt::new(to_address.clone(), vec![])).await,
+                self
+            );
        }

        // Data
-        self.command(Data).await?;
+        try_smtp!(self.command(Data).await, self);

        // Message content
-        self.message(email).await
+        let result = try_smtp!(self.message(email).await, self);
+        Ok(result)
    }

    pub fn has_broken(&self) -> bool {
-        match self.stream.get_ref().state() {
-            ConnectionState::Ok => false,
-            ConnectionState::Broken | ConnectionState::Closed => true,
-        }
+        self.panic
    }

    pub fn can_starttls(&self) -> bool {
@@ -189,20 +208,18 @@ impl AsyncSmtpConnection {
    /// [rfc8314]: https://www.rfc-editor.org/rfc/rfc8314
    #[allow(unused_variables)]
    pub async fn starttls(
-        mut self,
+        &mut self,
        tls_parameters: TlsParameters,
        hello_name: &ClientId,
-    ) -> Result<Self, Error> {
+    ) -> Result<(), Error> {
        if self.server_info.supports_feature(Extension::StartTls) {
-            self.command(Starttls).await?;
-            let stream = self.stream.into_inner();
-            let stream = stream.upgrade_tls(tls_parameters).await?;
-            self.stream = BufReader::new(stream);
+            try_smtp!(self.command(Starttls).await, self);
+            self.stream.get_mut().upgrade_tls(tls_parameters).await?;
            #[cfg(feature = "tracing")]
            tracing::debug!("connection encrypted");
            // Send EHLO again
-            self.ehlo(hello_name).await?;
-            Ok(self)
+            try_smtp!(self.ehlo(hello_name).await, self);
+            Ok(())
        } else {
            Err(error::client("STARTTLS is not supported on this server"))
        }
@@ -210,24 +227,22 @@ impl AsyncSmtpConnection {

    /// Send EHLO and update server info
    async fn ehlo(&mut self, hello_name: &ClientId) -> Result<(), Error> {
-        let ehlo_response = self.command(Ehlo::new(hello_name.clone())).await?;
-        self.server_info = ServerInfo::from_response(&ehlo_response)?;
+        let ehlo_response = try_smtp!(self.command(Ehlo::new(hello_name.clone())).await, self);
+        self.server_info = try_smtp!(ServerInfo::from_response(&ehlo_response), self);
        Ok(())
    }

    pub async fn quit(&mut self) -> Result<Response, Error> {
-        self.command(Quit).await
+        Ok(try_smtp!(self.command(Quit).await, self))
    }

    pub async fn abort(&mut self) {
-        match self.stream.get_ref().state() {
-            ConnectionState::Ok | ConnectionState::Broken => {
-                let _ = self.command(Quit).await;
-                let _ = self.stream.close().await;
-                self.stream.get_mut().set_state(ConnectionState::Closed);
-            }
-            ConnectionState::Closed => {}
+        // Only try to quit if we are not already broken
+        if !self.panic {
+            self.panic = true;
+            let _ = self.command(Quit).await;
        }
+        let _ = self.stream.close().await;
    }

    /// Sets the underlying stream
@@ -264,13 +279,15 @@ impl AsyncSmtpConnection {

        while challenges > 0 && response.has_code(334) {
            challenges -= 1;
-            response = self
-                .command(Auth::new_from_response(
+            response = try_smtp!(
+                self.command(Auth::new_from_response(
                    mechanism,
                    credentials.clone(),
                    &response,
                )?)
-                .await?;
+                .await,
+                self
+            );
        }

        if challenges == 0 {
@@ -298,9 +315,6 @@ impl AsyncSmtpConnection {

    /// Writes a string to the server
    async fn write(&mut self, string: &[u8]) -> Result<(), Error> {
-        self.stream.get_ref().state().verify()?;
-        self.stream.get_mut().set_state(ConnectionState::Broken);
-
        self.stream
            .get_mut()
            .write_all(string)
@@ -312,8 +326,6 @@ impl AsyncSmtpConnection {
            .await
            .map_err(error::network)?;

-        self.stream.get_mut().set_state(ConnectionState::Ok);
-
        #[cfg(feature = "tracing")]
        tracing::debug!("Wrote: {}", escape_crlf(&String::from_utf8_lossy(string)));
        Ok(())
@@ -321,9 +333,6 @@ impl AsyncSmtpConnection {

    /// Gets the SMTP response
    pub async fn read_response(&mut self) -> Result<Response, Error> {
-        self.stream.get_ref().state().verify()?;
-        self.stream.get_mut().set_state(ConnectionState::Broken);
-
        let mut buffer = String::with_capacity(100);

        while self
@@ -337,8 +346,6 @@ impl AsyncSmtpConnection {
            tracing::debug!("<< {}", escape_crlf(&buffer));
            match parse_response(&buffer) {
                Ok((_remaining, response)) => {
-                    self.stream.get_mut().set_state(ConnectionState::Ok);
-
                    return if response.is_positive() {
                        Ok(response)
                    } else {
@@ -346,7 +353,7 @@ impl AsyncSmtpConnection {
                            response.code(),
                            Some(response.message().collect()),
                        ))
-                    };
+                    }
                }
                Err(nom::Err::Failure(e)) => {
                    return Err(error::response(e.to_string()));
@@ -366,4 +373,10 @@ impl AsyncSmtpConnection {
    pub fn peer_certificate(&self) -> Result<Vec<u8>, Error> {
        self.stream.get_ref().peer_certificate()
    }
+
+    /// All the X509 certificates of the chain (DER encoded)
+    #[cfg(any(feature = "rustls-tls", feature = "boring-tls"))]
+    pub fn certificate_chain(&self) -> Result<Vec<Vec<u8>>, Error> {
+        self.stream.get_ref().certificate_chain()
+    }
 }
--- a/src/transport/smtp/client/async_net.rs
+++ b/src/transport/smtp/client/async_net.rs
@@ -6,12 +6,11 @@ use std::{
    time::Duration,
 };

-#[cfg(feature = "async-std1-native-tls")]
-use async_native_tls::TlsStream as AsyncStd1TlsStream;
 #[cfg(feature = "async-std1")]
 use async_std::net::{TcpStream as AsyncStd1TcpStream, ToSocketAddrs as AsyncStd1ToSocketAddrs};
 use futures_io::{
-    AsyncRead as FuturesAsyncRead, AsyncWrite as FuturesAsyncWrite, Result as IoResult,
+    AsyncRead as FuturesAsyncRead, AsyncWrite as FuturesAsyncWrite, Error as IoError, ErrorKind,
+    Result as IoResult,
 };
 #[cfg(feature = "async-std1-rustls-tls")]
 use futures_rustls::client::TlsStream as AsyncStd1RustlsTlsStream;
@@ -35,11 +34,10 @@ use tokio1_rustls::client::TlsStream as Tokio1RustlsTlsStream;
    feature = "tokio1-native-tls",
    feature = "tokio1-rustls-tls",
    feature = "tokio1-boring-tls",
-    feature = "async-std1-native-tls",
    feature = "async-std1-rustls-tls"
 ))]
 use super::InnerTlsParameters;
-use super::{ConnectionState, TlsParameters};
+use super::TlsParameters;
 #[cfg(feature = "tokio1")]
 use crate::transport::smtp::client::net::resolved_address_filter;
 use crate::transport::smtp::{error, Error};
@@ -48,7 +46,6 @@ use crate::transport::smtp::{error, Error};
 #[derive(Debug)]
 pub struct AsyncNetworkStream {
    inner: InnerAsyncNetworkStream,
-    state: ConnectionState,
 }

 #[cfg(feature = "tokio1")]
@@ -86,27 +83,19 @@ enum InnerAsyncNetworkStream {
    #[cfg(feature = "async-std1")]
    AsyncStd1Tcp(AsyncStd1TcpStream),
    /// Encrypted Tokio 1.x TCP stream
-    #[cfg(feature = "async-std1-native-tls")]
-    AsyncStd1NativeTls(AsyncStd1TlsStream<AsyncStd1TcpStream>),
-    /// Encrypted Tokio 1.x TCP stream
    #[cfg(feature = "async-std1-rustls-tls")]
    AsyncStd1RustlsTls(AsyncStd1RustlsTlsStream<AsyncStd1TcpStream>),
+    /// Can't be built
+    None,
 }

 impl AsyncNetworkStream {
    fn new(inner: InnerAsyncNetworkStream) -> Self {
-        AsyncNetworkStream {
-            inner,
-            state: ConnectionState::Ok,
+        if let InnerAsyncNetworkStream::None = inner {
+            debug_assert!(false, "InnerAsyncNetworkStream::None must never be built");
        }
-    }

-    pub(super) fn state(&self) -> ConnectionState {
-        self.state
-    }
-
-    pub(super) fn set_state(&mut self, state: ConnectionState) {
-        self.state = state;
+        AsyncNetworkStream { inner }
    }

    /// Returns peer's address
@@ -124,10 +113,15 @@ impl AsyncNetworkStream {
            InnerAsyncNetworkStream::Tokio1BoringTls(s) => s.get_ref().peer_addr(),
            #[cfg(feature = "async-std1")]
            InnerAsyncNetworkStream::AsyncStd1Tcp(s) => s.peer_addr(),
-            #[cfg(feature = "async-std1-native-tls")]
-            InnerAsyncNetworkStream::AsyncStd1NativeTls(s) => s.get_ref().peer_addr(),
            #[cfg(feature = "async-std1-rustls-tls")]
            InnerAsyncNetworkStream::AsyncStd1RustlsTls(s) => s.get_ref().0.peer_addr(),
+            InnerAsyncNetworkStream::None => {
+                debug_assert!(false, "InnerAsyncNetworkStream::None must never be built");
+                Err(IoError::new(
+                    ErrorKind::Other,
+                    "InnerAsyncNetworkStream::None must never be built",
+                ))
+            }
        }
    }

@@ -197,7 +191,7 @@ impl AsyncNetworkStream {
        let mut stream =
            AsyncNetworkStream::new(InnerAsyncNetworkStream::Tokio1Tcp(Box::new(tcp_stream)));
        if let Some(tls_parameters) = tls_parameters {
-            stream = stream.upgrade_tls(tls_parameters).await?;
+            stream.upgrade_tls(tls_parameters).await?;
        }
        Ok(stream)
    }
@@ -248,13 +242,13 @@ impl AsyncNetworkStream {

        let mut stream = AsyncNetworkStream::new(InnerAsyncNetworkStream::AsyncStd1Tcp(tcp_stream));
        if let Some(tls_parameters) = tls_parameters {
-            stream = stream.upgrade_tls(tls_parameters).await?;
+            stream.upgrade_tls(tls_parameters).await?;
        }
        Ok(stream)
    }

-    pub async fn upgrade_tls(self, tls_parameters: TlsParameters) -> Result<Self, Error> {
-        match self.inner {
+    pub async fn upgrade_tls(&mut self, tls_parameters: TlsParameters) -> Result<(), Error> {
+        match &self.inner {
            #[cfg(all(
                feature = "tokio1",
                not(any(
@@ -273,35 +267,40 @@ impl AsyncNetworkStream {
                feature = "tokio1-rustls-tls",
                feature = "tokio1-boring-tls"
            ))]
-            InnerAsyncNetworkStream::Tokio1Tcp(tcp_stream) => {
-                let inner = Self::upgrade_tokio1_tls(tcp_stream, tls_parameters)
+            InnerAsyncNetworkStream::Tokio1Tcp(_) => {
+                // get owned TcpStream
+                let tcp_stream = mem::replace(&mut self.inner, InnerAsyncNetworkStream::None);
+                let tcp_stream = match tcp_stream {
+                    InnerAsyncNetworkStream::Tokio1Tcp(tcp_stream) => tcp_stream,
+                    _ => unreachable!(),
+                };
+
+                self.inner = Self::upgrade_tokio1_tls(tcp_stream, tls_parameters)
                    .await
                    .map_err(error::connection)?;
-                Ok(Self {
-                    inner,
-                    state: ConnectionState::Ok,
-                })
+                Ok(())
            }
-            #[cfg(all(
-                feature = "async-std1",
-                not(any(feature = "async-std1-native-tls", feature = "async-std1-rustls-tls"))
-            ))]
+            #[cfg(all(feature = "async-std1", not(feature = "async-std1-rustls-tls")))]
            InnerAsyncNetworkStream::AsyncStd1Tcp(_) => {
                let _ = tls_parameters;
-                panic!("Trying to upgrade an AsyncNetworkStream without having enabled either the async-std1-native-tls or the async-std1-rustls-tls feature");
+                panic!("Trying to upgrade an AsyncNetworkStream without having enabled the async-std1-rustls-tls feature");
            }

-            #[cfg(any(feature = "async-std1-native-tls", feature = "async-std1-rustls-tls"))]
-            InnerAsyncNetworkStream::AsyncStd1Tcp(tcp_stream) => {
-                let inner = Self::upgrade_asyncstd1_tls(tcp_stream, tls_parameters)
+            #[cfg(feature = "async-std1-rustls-tls")]
+            InnerAsyncNetworkStream::AsyncStd1Tcp(_) => {
+                // get owned TcpStream
+                let tcp_stream = mem::replace(&mut self.inner, InnerAsyncNetworkStream::None);
+                let tcp_stream = match tcp_stream {
+                    InnerAsyncNetworkStream::AsyncStd1Tcp(tcp_stream) => tcp_stream,
+                    _ => unreachable!(),
+                };
+
+                self.inner = Self::upgrade_asyncstd1_tls(tcp_stream, tls_parameters)
                    .await
                    .map_err(error::connection)?;
-                Ok(Self {
-                    inner,
-                    state: ConnectionState::Ok,
-                })
+                Ok(())
            }
-            _ => Ok(self),
+            _ => Ok(()),
        }
    }

@@ -375,11 +374,7 @@ impl AsyncNetworkStream {
    }

    #[allow(unused_variables)]
-    #[cfg(any(
-        feature = "async-std1-native-tls",
-        feature = "async-std1-rustls-tls",
-        feature = "async-std1-boring-tls"
-    ))]
+    #[cfg(feature = "async-std1-rustls-tls")]
    async fn upgrade_asyncstd1_tls(
        tcp_stream: AsyncStd1TcpStream,
        mut tls_parameters: TlsParameters,
@@ -390,22 +385,6 @@ impl AsyncNetworkStream {
            #[cfg(feature = "native-tls")]
            InnerTlsParameters::NativeTls(connector) => {
                panic!("native-tls isn't supported with async-std yet. See https://github.com/lettre/lettre/pull/531#issuecomment-757893531");
-
-                /*
-                #[cfg(not(feature = "async-std1-native-tls"))]
-                panic!("built without the async-std1-native-tls feature");
-
-                #[cfg(feature = "async-std1-native-tls")]
-                return {
-                    use async_native_tls::TlsConnector;
-
-                    // TODO: fix
-                    let connector: TlsConnector = todo!();
-                    // let connector = TlsConnector::from(connector);
-                    let stream = connector.connect(&domain, tcp_stream).await?;
-                    Ok(InnerAsyncNetworkStream::AsyncStd1NativeTls(stream))
-                };
-                */
            }
            #[cfg(feature = "rustls-tls")]
            InnerTlsParameters::RustlsTls(config) => {
@@ -446,10 +425,51 @@ impl AsyncNetworkStream {
            InnerAsyncNetworkStream::Tokio1BoringTls(_) => true,
            #[cfg(feature = "async-std1")]
            InnerAsyncNetworkStream::AsyncStd1Tcp(_) => false,
-            #[cfg(feature = "async-std1-native-tls")]
-            InnerAsyncNetworkStream::AsyncStd1NativeTls(_) => true,
            #[cfg(feature = "async-std1-rustls-tls")]
            InnerAsyncNetworkStream::AsyncStd1RustlsTls(_) => true,
+            InnerAsyncNetworkStream::None => false,
+        }
+    }
+
+    pub fn certificate_chain(&self) -> Result<Vec<Vec<u8>>, Error> {
+        match &self.inner {
+            #[cfg(feature = "tokio1")]
+            InnerAsyncNetworkStream::Tokio1Tcp(_) => {
+                Err(error::client("Connection is not encrypted"))
+            }
+            #[cfg(feature = "tokio1-native-tls")]
+            InnerAsyncNetworkStream::Tokio1NativeTls(_) => panic!("Unsupported"),
+            #[cfg(feature = "tokio1-rustls-tls")]
+            InnerAsyncNetworkStream::Tokio1RustlsTls(stream) => Ok(stream
+                .get_ref()
+                .1
+                .peer_certificates()
+                .unwrap()
+                .iter()
+                .map(|c| c.to_vec())
+                .collect()),
+            #[cfg(feature = "tokio1-boring-tls")]
+            InnerAsyncNetworkStream::Tokio1BoringTls(stream) => Ok(stream
+                .ssl()
+                .peer_cert_chain()
+                .unwrap()
+                .iter()
+                .map(|c| c.to_der().map_err(error::tls))
+                .collect::<Result<Vec<_>, _>>()?),
+            #[cfg(feature = "async-std1")]
+            InnerAsyncNetworkStream::AsyncStd1Tcp(_) => {
+                Err(error::client("Connection is not encrypted"))
+            }
+            #[cfg(feature = "async-std1-rustls-tls")]
+            InnerAsyncNetworkStream::AsyncStd1RustlsTls(stream) => Ok(stream
+                .get_ref()
+                .1
+                .peer_certificates()
+                .unwrap()
+                .iter()
+                .map(|c| c.to_vec())
+                .collect()),
+            InnerAsyncNetworkStream::None => panic!("InnerNetworkStream::None must never be built"),
        }
    }

@@ -487,8 +507,6 @@ impl AsyncNetworkStream {
            InnerAsyncNetworkStream::AsyncStd1Tcp(_) => {
                Err(error::client("Connection is not encrypted"))
            }
-            #[cfg(feature = "async-std1-native-tls")]
-            InnerAsyncNetworkStream::AsyncStd1NativeTls(t) => panic!("Unsupported"),
            #[cfg(feature = "async-std1-rustls-tls")]
            InnerAsyncNetworkStream::AsyncStd1RustlsTls(stream) => Ok(stream
                .get_ref()
@@ -498,6 +516,7 @@ impl AsyncNetworkStream {
                .first()
                .unwrap()
                .to_vec()),
+            InnerAsyncNetworkStream::None => panic!("InnerNetworkStream::None must never be built"),
        }
    }
 }
@@ -547,10 +566,12 @@ impl FuturesAsyncRead for AsyncNetworkStream {
            }
            #[cfg(feature = "async-std1")]
            InnerAsyncNetworkStream::AsyncStd1Tcp(s) => Pin::new(s).poll_read(cx, buf),
-            #[cfg(feature = "async-std1-native-tls")]
-            InnerAsyncNetworkStream::AsyncStd1NativeTls(s) => Pin::new(s).poll_read(cx, buf),
            #[cfg(feature = "async-std1-rustls-tls")]
            InnerAsyncNetworkStream::AsyncStd1RustlsTls(s) => Pin::new(s).poll_read(cx, buf),
+            InnerAsyncNetworkStream::None => {
+                debug_assert!(false, "InnerAsyncNetworkStream::None must never be built");
+                Poll::Ready(Ok(0))
+            }
        }
    }
 }
@@ -572,10 +593,12 @@ impl FuturesAsyncWrite for AsyncNetworkStream {
            InnerAsyncNetworkStream::Tokio1BoringTls(s) => Pin::new(s).poll_write(cx, buf),
            #[cfg(feature = "async-std1")]
            InnerAsyncNetworkStream::AsyncStd1Tcp(s) => Pin::new(s).poll_write(cx, buf),
-            #[cfg(feature = "async-std1-native-tls")]
-            InnerAsyncNetworkStream::AsyncStd1NativeTls(s) => Pin::new(s).poll_write(cx, buf),
            #[cfg(feature = "async-std1-rustls-tls")]
            InnerAsyncNetworkStream::AsyncStd1RustlsTls(s) => Pin::new(s).poll_write(cx, buf),
+            InnerAsyncNetworkStream::None => {
+                debug_assert!(false, "InnerAsyncNetworkStream::None must never be built");
+                Poll::Ready(Ok(0))
+            }
        }
    }

@@ -591,16 +614,16 @@ impl FuturesAsyncWrite for AsyncNetworkStream {
            InnerAsyncNetworkStream::Tokio1BoringTls(s) => Pin::new(s).poll_flush(cx),
            #[cfg(feature = "async-std1")]
            InnerAsyncNetworkStream::AsyncStd1Tcp(s) => Pin::new(s).poll_flush(cx),
-            #[cfg(feature = "async-std1-native-tls")]
-            InnerAsyncNetworkStream::AsyncStd1NativeTls(s) => Pin::new(s).poll_flush(cx),
            #[cfg(feature = "async-std1-rustls-tls")]
            InnerAsyncNetworkStream::AsyncStd1RustlsTls(s) => Pin::new(s).poll_flush(cx),
+            InnerAsyncNetworkStream::None => {
+                debug_assert!(false, "InnerAsyncNetworkStream::None must never be built");
+                Poll::Ready(Ok(()))
+            }
        }
    }

    fn poll_close(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<IoResult<()>> {
-        self.state = ConnectionState::Closed;
-
        match &mut self.inner {
            #[cfg(feature = "tokio1")]
            InnerAsyncNetworkStream::Tokio1Tcp(s) => Pin::new(s).poll_shutdown(cx),
@@ -612,10 +635,12 @@ impl FuturesAsyncWrite for AsyncNetworkStream {
            InnerAsyncNetworkStream::Tokio1BoringTls(s) => Pin::new(s).poll_shutdown(cx),
            #[cfg(feature = "async-std1")]
            InnerAsyncNetworkStream::AsyncStd1Tcp(s) => Pin::new(s).poll_close(cx),
-            #[cfg(feature = "async-std1-native-tls")]
-            InnerAsyncNetworkStream::AsyncStd1NativeTls(s) => Pin::new(s).poll_close(cx),
            #[cfg(feature = "async-std1-rustls-tls")]
            InnerAsyncNetworkStream::AsyncStd1RustlsTls(s) => Pin::new(s).poll_close(cx),
+            InnerAsyncNetworkStream::None => {
+                debug_assert!(false, "InnerAsyncNetworkStream::None must never be built");
+                Poll::Ready(Ok(()))
+            }
        }
    }
 }
--- a/src/transport/smtp/client/connection.rs
+++ b/src/transport/smtp/client/connection.rs
@@ -7,7 +7,7 @@ use std::{

 #[cfg(feature = "tracing")]
 use super::escape_crlf;
-use super::{ClientCodec, ConnectionState, NetworkStream, TlsParameters};
+use super::{ClientCodec, NetworkStream, TlsParameters};
 use crate::{
    address::Envelope,
    transport::smtp::{
@@ -20,11 +20,25 @@ use crate::{
    },
 };

+macro_rules! try_smtp (
+    ($err: expr, $client: ident) => ({
+        match $err {
+            Ok(val) => val,
+            Err(err) => {
+                $client.abort();
+                return Err(From::from(err))
+            },
+        }
+    })
+);
+
 /// Structure that implements the SMTP client
 pub struct SmtpConnection {
    /// TCP stream between client and server
    /// Value is None before connection
    stream: BufReader<NetworkStream>,
+    /// Panic state
+    panic: bool,
    /// Information about the server
    server_info: ServerInfo,
 }
@@ -51,6 +65,7 @@ impl SmtpConnection {
        let stream = BufReader::new(stream);
        let mut conn = SmtpConnection {
            stream,
+            panic: false,
            server_info: ServerInfo::default(),
        };
        conn.set_timeout(timeout).map_err(error::network)?;
@@ -95,25 +110,26 @@ impl SmtpConnection {
            mail_options.push(MailParameter::Body(MailBodyParameter::EightBitMime));
        }

-        self.command(Mail::new(envelope.from().cloned(), mail_options))?;
+        try_smtp!(
+            self.command(Mail::new(envelope.from().cloned(), mail_options)),
+            self
+        );

        // Recipient
        for to_address in envelope.to() {
-            self.command(Rcpt::new(to_address.clone(), vec![]))?;
+            try_smtp!(self.command(Rcpt::new(to_address.clone(), vec![])), self);
        }

        // Data
-        self.command(Data)?;
+        try_smtp!(self.command(Data), self);

        // Message content
-        self.message(email)
+        let result = try_smtp!(self.message(email), self);
+        Ok(result)
    }

    pub fn has_broken(&self) -> bool {
-        match self.stream.get_ref().state() {
-            ConnectionState::Ok => false,
-            ConnectionState::Broken | ConnectionState::Closed => true,
-        }
+        self.panic
    }

    pub fn can_starttls(&self) -> bool {
@@ -122,22 +138,20 @@ impl SmtpConnection {

    #[allow(unused_variables)]
    pub fn starttls(
-        mut self,
+        &mut self,
        tls_parameters: &TlsParameters,
        hello_name: &ClientId,
-    ) -> Result<Self, Error> {
+    ) -> Result<(), Error> {
        if self.server_info.supports_feature(Extension::StartTls) {
            #[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "boring-tls"))]
            {
-                self.command(Starttls)?;
-                let stream = self.stream.into_inner();
-                let stream = stream.upgrade_tls(tls_parameters)?;
-                self.stream = BufReader::new(stream);
+                try_smtp!(self.command(Starttls), self);
+                self.stream.get_mut().upgrade_tls(tls_parameters)?;
                #[cfg(feature = "tracing")]
                tracing::debug!("connection encrypted");
                // Send EHLO again
-                self.ehlo(hello_name)?;
-                Ok(self)
+                try_smtp!(self.ehlo(hello_name), self);
+                Ok(())
            }
            #[cfg(not(any(
                feature = "native-tls",
@@ -154,24 +168,22 @@ impl SmtpConnection {

    /// Send EHLO and update server info
    fn ehlo(&mut self, hello_name: &ClientId) -> Result<(), Error> {
-        let ehlo_response = self.command(Ehlo::new(hello_name.clone()))?;
-        self.server_info = ServerInfo::from_response(&ehlo_response)?;
+        let ehlo_response = try_smtp!(self.command(Ehlo::new(hello_name.clone())), self);
+        self.server_info = try_smtp!(ServerInfo::from_response(&ehlo_response), self);
        Ok(())
    }

    pub fn quit(&mut self) -> Result<Response, Error> {
-        self.command(Quit)
+        Ok(try_smtp!(self.command(Quit), self))
    }

    pub fn abort(&mut self) {
-        match self.stream.get_ref().state() {
-            ConnectionState::Ok | ConnectionState::Broken => {
-                let _ = self.command(Quit);
-                let _ = self.stream.get_mut().shutdown(std::net::Shutdown::Both);
-                self.stream.get_mut().set_state(ConnectionState::Closed);
-            }
-            ConnectionState::Closed => {}
+        // Only try to quit if we are not already broken
+        if !self.panic {
+            self.panic = true;
+            let _ = self.command(Quit);
        }
+        let _ = self.stream.get_mut().shutdown(std::net::Shutdown::Both);
    }

    /// Sets the underlying stream
@@ -212,11 +224,14 @@ impl SmtpConnection {

        while challenges > 0 && response.has_code(334) {
            challenges -= 1;
-            response = self.command(Auth::new_from_response(
-                mechanism,
-                credentials.clone(),
-                &response,
-            )?)?;
+            response = try_smtp!(
+                self.command(Auth::new_from_response(
+                    mechanism,
+                    credentials.clone(),
+                    &response,
+                )?),
+                self
+            );
        }

        if challenges == 0 {
@@ -245,17 +260,12 @@ impl SmtpConnection {

    /// Writes a string to the server
    fn write(&mut self, string: &[u8]) -> Result<(), Error> {
-        self.stream.get_ref().state().verify()?;
-        self.stream.get_mut().set_state(ConnectionState::Broken);
-
        self.stream
            .get_mut()
            .write_all(string)
            .map_err(error::network)?;
        self.stream.get_mut().flush().map_err(error::network)?;

-        self.stream.get_mut().set_state(ConnectionState::Ok);
-
        #[cfg(feature = "tracing")]
        tracing::debug!("Wrote: {}", escape_crlf(&String::from_utf8_lossy(string)));
        Ok(())
@@ -263,9 +273,6 @@ impl SmtpConnection {

    /// Gets the SMTP response
    pub fn read_response(&mut self) -> Result<Response, Error> {
-        self.stream.get_ref().state().verify()?;
-        self.stream.get_mut().set_state(ConnectionState::Broken);
-
        let mut buffer = String::with_capacity(100);

        while self.stream.read_line(&mut buffer).map_err(error::network)? > 0 {
@@ -273,8 +280,6 @@ impl SmtpConnection {
            tracing::debug!("<< {}", escape_crlf(&buffer));
            match parse_response(&buffer) {
                Ok((_remaining, response)) => {
-                    self.stream.get_mut().set_state(ConnectionState::Ok);
-
                    return if response.is_positive() {
                        Ok(response)
                    } else {
@@ -302,4 +307,10 @@ impl SmtpConnection {
    pub fn peer_certificate(&self) -> Result<Vec<u8>, Error> {
        self.stream.get_ref().peer_certificate()
    }
+
+    /// All the X509 certificates of the chain (DER encoded)
+    #[cfg(any(feature = "rustls-tls", feature = "boring-tls"))]
+    pub fn certificate_chain(&self) -> Result<Vec<Vec<u8>>, Error> {
+        self.stream.get_ref().certificate_chain()
+    }
 }
--- a/src/transport/smtp/client/mod.rs
+++ b/src/transport/smtp/client/mod.rs
@@ -38,9 +38,8 @@ pub(super) use self::tls::InnerTlsParameters;
 pub use self::tls::TlsVersion;
 pub use self::{
    connection::SmtpConnection,
-    tls::{Certificate, CertificateStore, Tls, TlsParameters, TlsParametersBuilder},
+    tls::{Certificate, CertificateStore, Identity, Tls, TlsParameters, TlsParametersBuilder},
 };
-use super::{error, Error};

 #[cfg(any(feature = "tokio1", feature = "async-std1"))]
 mod async_connection;
@@ -50,23 +49,6 @@ mod connection;
 mod net;
 mod tls;

-#[derive(Debug, Copy, Clone)]
-enum ConnectionState {
-    Ok,
-    Broken,
-    Closed,
-}
-
-impl ConnectionState {
-    fn verify(&mut self) -> Result<(), Error> {
-        match self {
-            Self::Ok => Ok(()),
-            Self::Broken => Err(error::connection("connection broken")),
-            Self::Closed => Err(error::connection("connection closed")),
-        }
-    }
-}
-
 /// The codec used for transparency
 #[derive(Debug)]
 struct ClientCodec {
@@ -157,7 +139,7 @@ mod test {
    }

    #[test]
-    #[cfg(feature = "log")]
+    #[cfg(feature = "tracing")]
    fn test_escape_crlf() {
        assert_eq!(escape_crlf("\r\n"), "<CRLF>");
        assert_eq!(escape_crlf("EHLO my_name\r\n"), "EHLO my_name<CRLF>");
--- a/src/transport/smtp/client/net.rs
+++ b/src/transport/smtp/client/net.rs
@@ -2,7 +2,8 @@
 use std::sync::Arc;
 use std::{
    io::{self, Read, Write},
-    net::{IpAddr, Shutdown, SocketAddr, TcpStream, ToSocketAddrs},
+    mem,
+    net::{IpAddr, Ipv4Addr, Shutdown, SocketAddr, SocketAddrV4, TcpStream, ToSocketAddrs},
    time::Duration,
 };

@@ -16,13 +17,12 @@ use socket2::{Domain, Protocol, Type};

 #[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "boring-tls"))]
 use super::InnerTlsParameters;
-use super::{ConnectionState, TlsParameters};
+use super::TlsParameters;
 use crate::transport::smtp::{error, Error};

 /// A network stream
 pub struct NetworkStream {
    inner: InnerNetworkStream,
-    state: ConnectionState,
 }

 /// Represents the different types of underlying network streams
@@ -40,22 +40,17 @@ enum InnerNetworkStream {
    RustlsTls(StreamOwned<ClientConnection, TcpStream>),
    #[cfg(feature = "boring-tls")]
    BoringTls(SslStream<TcpStream>),
+    /// Can't be built
+    None,
 }

 impl NetworkStream {
    fn new(inner: InnerNetworkStream) -> Self {
-        NetworkStream {
-            inner,
-            state: ConnectionState::Ok,
+        if let InnerNetworkStream::None = inner {
+            debug_assert!(false, "InnerNetworkStream::None must never be built");
        }
-    }

-    pub(super) fn state(&self) -> ConnectionState {
-        self.state
-    }
-
-    pub(super) fn set_state(&mut self, state: ConnectionState) {
-        self.state = state;
+        NetworkStream { inner }
    }

    /// Returns peer's address
@@ -68,13 +63,18 @@ impl NetworkStream {
            InnerNetworkStream::RustlsTls(s) => s.get_ref().peer_addr(),
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(s) => s.get_ref().peer_addr(),
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                Ok(SocketAddr::V4(SocketAddrV4::new(
+                    Ipv4Addr::new(127, 0, 0, 1),
+                    80,
+                )))
+            }
        }
    }

    /// Shutdowns the connection
-    pub fn shutdown(&mut self, how: Shutdown) -> io::Result<()> {
-        self.state = ConnectionState::Closed;
-
+    pub fn shutdown(&self, how: Shutdown) -> io::Result<()> {
        match &self.inner {
            InnerNetworkStream::Tcp(s) => s.shutdown(how),
            #[cfg(feature = "native-tls")]
@@ -83,6 +83,10 @@ impl NetworkStream {
            InnerNetworkStream::RustlsTls(s) => s.get_ref().shutdown(how),
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(s) => s.get_ref().shutdown(how),
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                Ok(())
+            }
        }
    }

@@ -135,13 +139,13 @@ impl NetworkStream {
        let tcp_stream = try_connect(server, timeout, local_addr)?;
        let mut stream = NetworkStream::new(InnerNetworkStream::Tcp(tcp_stream));
        if let Some(tls_parameters) = tls_parameters {
-            stream = stream.upgrade_tls(tls_parameters)?;
+            stream.upgrade_tls(tls_parameters)?;
        }
        Ok(stream)
    }

-    pub fn upgrade_tls(self, tls_parameters: &TlsParameters) -> Result<Self, Error> {
-        match self.inner {
+    pub fn upgrade_tls(&mut self, tls_parameters: &TlsParameters) -> Result<(), Error> {
+        match &self.inner {
            #[cfg(not(any(
                feature = "native-tls",
                feature = "rustls-tls",
@@ -153,14 +157,18 @@ impl NetworkStream {
            }

            #[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "boring-tls"))]
-            InnerNetworkStream::Tcp(tcp_stream) => {
-                let inner = Self::upgrade_tls_impl(tcp_stream, tls_parameters)?;
-                Ok(Self {
-                    inner,
-                    state: ConnectionState::Ok,
-                })
+            InnerNetworkStream::Tcp(_) => {
+                // get owned TcpStream
+                let tcp_stream = mem::replace(&mut self.inner, InnerNetworkStream::None);
+                let tcp_stream = match tcp_stream {
+                    InnerNetworkStream::Tcp(tcp_stream) => tcp_stream,
+                    _ => unreachable!(),
+                };
+
+                self.inner = Self::upgrade_tls_impl(tcp_stream, tls_parameters)?;
+                Ok(())
            }
-            _ => Ok(self),
+            _ => Ok(()),
        }
    }

@@ -208,6 +216,36 @@ impl NetworkStream {
            InnerNetworkStream::RustlsTls(_) => true,
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(_) => true,
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                false
+            }
+        }
+    }
+
+    #[cfg(any(feature = "rustls-tls", feature = "boring-tls"))]
+    pub fn certificate_chain(&self) -> Result<Vec<Vec<u8>>, Error> {
+        match &self.inner {
+            InnerNetworkStream::Tcp(_) => Err(error::client("Connection is not encrypted")),
+            #[cfg(feature = "native-tls")]
+            InnerNetworkStream::NativeTls(_) => panic!("Unsupported"),
+            #[cfg(feature = "rustls-tls")]
+            InnerNetworkStream::RustlsTls(stream) => Ok(stream
+                .conn
+                .peer_certificates()
+                .unwrap()
+                .iter()
+                .map(|c| c.to_vec())
+                .collect()),
+            #[cfg(feature = "boring-tls")]
+            InnerNetworkStream::BoringTls(stream) => Ok(stream
+                .ssl()
+                .peer_cert_chain()
+                .unwrap()
+                .iter()
+                .map(|c| c.to_der().map_err(error::tls))
+                .collect::<Result<Vec<_>, _>>()?),
+            InnerNetworkStream::None => panic!("InnerNetworkStream::None must never be built"),
        }
    }

@@ -237,6 +275,7 @@ impl NetworkStream {
                .unwrap()
                .to_der()
                .map_err(error::tls)?),
+            InnerNetworkStream::None => panic!("InnerNetworkStream::None must never be built"),
        }
    }

@@ -249,6 +288,10 @@ impl NetworkStream {
            InnerNetworkStream::RustlsTls(stream) => stream.get_ref().set_read_timeout(duration),
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(stream) => stream.get_ref().set_read_timeout(duration),
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                Ok(())
+            }
        }
    }

@@ -263,6 +306,10 @@ impl NetworkStream {
            InnerNetworkStream::RustlsTls(stream) => stream.get_ref().set_write_timeout(duration),
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(stream) => stream.get_ref().set_write_timeout(duration),
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                Ok(())
+            }
        }
    }
 }
@@ -277,6 +324,10 @@ impl Read for NetworkStream {
            InnerNetworkStream::RustlsTls(s) => s.read(buf),
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(s) => s.read(buf),
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                Ok(0)
+            }
        }
    }
 }
@@ -291,6 +342,10 @@ impl Write for NetworkStream {
            InnerNetworkStream::RustlsTls(s) => s.write(buf),
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(s) => s.write(buf),
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                Ok(0)
+            }
        }
    }

@@ -303,6 +358,10 @@ impl Write for NetworkStream {
            InnerNetworkStream::RustlsTls(s) => s.flush(),
            #[cfg(feature = "boring-tls")]
            InnerNetworkStream::BoringTls(s) => s.flush(),
+            InnerNetworkStream::None => {
+                debug_assert!(false, "InnerNetworkStream::None must never be built");
+                Ok(())
+            }
        }
    }
 }
--- a/src/transport/smtp/client/tls.rs
+++ b/src/transport/smtp/client/tls.rs
@@ -4,6 +4,7 @@ use std::{io, sync::Arc};

 #[cfg(feature = "boring-tls")]
 use boring::{
+    pkey::PKey,
    ssl::{SslConnector, SslVersion},
    x509::store::X509StoreBuilder,
 };
@@ -12,8 +13,10 @@ use native_tls::{Protocol, TlsConnector};
 #[cfg(feature = "rustls-tls")]
 use rustls::{
    client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier},
+    crypto::WebPkiSupportedAlgorithms,
    crypto::{verify_tls12_signature, verify_tls13_signature},
-    pki_types::{CertificateDer, ServerName, UnixTime},
+    pki_types::{CertificateDer, PrivateKeyDer, ServerName, UnixTime},
+    server::ParsedCertificate,
    ClientConfig, DigitallySignedStruct, Error as TlsError, RootCertStore, SignatureScheme,
 };

@@ -108,7 +111,7 @@ pub enum CertificateStore {
    /// For native-tls, this will use the system certificate store on Windows, the keychain on
    /// macOS, and OpenSSL directories on Linux (usually `/etc/ssl`).
    ///
-    /// For rustls, this will also use the the system store if the `rustls-native-certs` feature is
+    /// For rustls, this will also use the system store if the `rustls-native-certs` feature is
    /// enabled, or will fall back to `webpki-roots`.
    ///
    /// The boring-tls backend uses the same logic as OpenSSL on all platforms.
@@ -139,6 +142,7 @@ pub struct TlsParametersBuilder {
    domain: String,
    cert_store: CertificateStore,
    root_certs: Vec<Certificate>,
+    identity: Option<Identity>,
    accept_invalid_hostnames: bool,
    accept_invalid_certs: bool,
    #[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "boring-tls"))]
@@ -152,6 +156,7 @@ impl TlsParametersBuilder {
            domain,
            cert_store: CertificateStore::Default,
            root_certs: Vec::new(),
+            identity: None,
            accept_invalid_hostnames: false,
            accept_invalid_certs: false,
            #[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "boring-tls"))]
@@ -167,12 +172,20 @@ impl TlsParametersBuilder {

    /// Add a custom root certificate
    ///
-    /// Can be used to safely connect to a server using a self signed certificate, for example.
+    /// Can be used to safely connect to a server using a self-signed certificate, for example.
    pub fn add_root_certificate(mut self, cert: Certificate) -> Self {
        self.root_certs.push(cert);
        self
    }

+    /// Add a client certificate
+    ///
+    /// Can be used to configure a client certificate to present to the server.
+    pub fn identify_with(mut self, identity: Identity) -> Self {
+        self.identity = Some(identity);
+        self
+    }
+
    /// Controls whether certificates with an invalid hostname are accepted
    ///
    /// Defaults to `false`.
@@ -184,10 +197,11 @@ impl TlsParametersBuilder {
    /// including those from other sites, are trusted.
    ///
    /// This method introduces significant vulnerabilities to man-in-the-middle attacks.
-    ///
-    /// Hostname verification can only be disabled with the `native-tls` TLS backend.
    #[cfg(any(feature = "native-tls", feature = "boring-tls"))]
-    #[cfg_attr(docsrs, doc(cfg(any(feature = "native-tls", feature = "boring-tls"))))]
+    #[cfg_attr(
+        docsrs,
+        doc(cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "boring-tls")))
+    )]
    pub fn dangerous_accept_invalid_hostnames(mut self, accept_invalid_hostnames: bool) -> Self {
        self.accept_invalid_hostnames = accept_invalid_hostnames;
        self
@@ -275,6 +289,10 @@ impl TlsParametersBuilder {
        };

        tls_builder.min_protocol_version(Some(min_tls_version));
+        if let Some(identity) = self.identity {
+            tls_builder.identity(identity.native_tls);
+        }
+
        let connector = tls_builder.build().map_err(error::tls)?;
        Ok(TlsParameters {
            connector: InnerTlsParameters::NativeTls(connector),
@@ -317,6 +335,15 @@ impl TlsParametersBuilder {
            }
        }

+        if let Some(identity) = self.identity {
+            tls_builder
+                .set_certificate(identity.boring_tls.0.as_ref())
+                .map_err(error::tls)?;
+            tls_builder
+                .set_private_key(identity.boring_tls.1.as_ref())
+                .map_err(error::tls)?;
+        }
+
        let min_tls_version = match self.min_tls_version {
            TlsVersion::Tlsv10 => SslVersion::TLS1,
            TlsVersion::Tlsv11 => SslVersion::TLS1_1,
@@ -352,51 +379,70 @@ impl TlsParametersBuilder {
        };

        let tls = ClientConfig::builder_with_protocol_versions(supported_versions);
+        let provider = rustls::crypto::CryptoProvider::get_default()
+            .cloned()
+            .unwrap_or_else(|| Arc::new(rustls::crypto::ring::default_provider()));

-        let tls = if self.accept_invalid_certs {
-            tls.dangerous()
-                .with_custom_certificate_verifier(Arc::new(InvalidCertsVerifier {}))
-        } else {
-            let mut root_cert_store = RootCertStore::empty();
+        // Build TLS config
+        let signature_algorithms = provider.signature_verification_algorithms;

-            #[cfg(feature = "rustls-native-certs")]
-            fn load_native_roots(store: &mut RootCertStore) -> Result<(), Error> {
-                let native_certs = rustls_native_certs::load_native_certs().map_err(error::tls)?;
-                let (added, ignored) = store.add_parsable_certificates(native_certs);
-                #[cfg(feature = "tracing")]
-                tracing::debug!(
-                    "loaded platform certs with {added} valid and {ignored} ignored (invalid) certs"
-                );
-                Ok(())
+        let mut root_cert_store = RootCertStore::empty();
+
+        #[cfg(feature = "rustls-native-certs")]
+        fn load_native_roots(store: &mut RootCertStore) -> Result<(), Error> {
+            let native_certs = rustls_native_certs::load_native_certs().map_err(error::tls)?;
+            let (added, ignored) = store.add_parsable_certificates(native_certs);
+            #[cfg(feature = "tracing")]
+            tracing::debug!(
+                "loaded platform certs with {added} valid and {ignored} ignored (invalid) certs"
+            );
+            Ok(())
+        }
+
+        #[cfg(feature = "rustls-tls")]
+        fn load_webpki_roots(store: &mut RootCertStore) {
+            store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
+        }
+
+        match self.cert_store {
+            CertificateStore::Default => {
+                #[cfg(feature = "rustls-native-certs")]
+                load_native_roots(&mut root_cert_store)?;
+                #[cfg(not(feature = "rustls-native-certs"))]
+                load_webpki_roots(&mut root_cert_store);
            }
-
            #[cfg(feature = "rustls-tls")]
-            fn load_webpki_roots(store: &mut RootCertStore) {
-                store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-            }
-
-            match self.cert_store {
-                CertificateStore::Default => {
-                    #[cfg(feature = "rustls-native-certs")]
-                    load_native_roots(&mut root_cert_store)?;
-                    #[cfg(not(feature = "rustls-native-certs"))]
-                    load_webpki_roots(&mut root_cert_store);
-                }
-                #[cfg(feature = "rustls-tls")]
-                CertificateStore::WebpkiRoots => {
-                    load_webpki_roots(&mut root_cert_store);
-                }
-                CertificateStore::None => {}
-            }
-            for cert in self.root_certs {
-                for rustls_cert in cert.rustls {
-                    root_cert_store.add(rustls_cert).map_err(error::tls)?;
-                }
+            CertificateStore::WebpkiRoots => {
+                load_webpki_roots(&mut root_cert_store);
            }
+            CertificateStore::None => {}
+        }
+        for cert in self.root_certs {
+            for rustls_cert in cert.rustls {
+                root_cert_store.add(rustls_cert).map_err(error::tls)?;
+            }
+        }

+        let tls = if self.accept_invalid_certs || self.accept_invalid_hostnames {
+            let verifier = InvalidCertsVerifier {
+                ignore_invalid_hostnames: self.accept_invalid_hostnames,
+                ignore_invalid_certs: self.accept_invalid_certs,
+                roots: root_cert_store,
+                signature_algorithms,
+            };
+            tls.dangerous()
+                .with_custom_certificate_verifier(Arc::new(verifier))
+        } else {
            tls.with_root_certificates(root_cert_store)
        };
-        let tls = tls.with_no_client_auth();
+
+        let tls = if let Some(identity) = self.identity {
+            let (client_certificates, private_key) = identity.rustls_tls;
+            tls.with_client_auth_cert(client_certificates, private_key)
+                .map_err(error::tls)?
+        } else {
+            tls.with_no_client_auth()
+        };

        Ok(TlsParameters {
            connector: InnerTlsParameters::RustlsTls(Arc::new(tls)),
@@ -461,7 +507,7 @@ impl TlsParameters {
    }
 }

-/// A client certificate that can be used with [`TlsParametersBuilder::add_root_certificate`]
+/// A certificate that can be used with [`TlsParametersBuilder::add_root_certificate`]
 #[derive(Clone)]
 #[allow(missing_copy_implementations)]
 pub struct Certificate {
@@ -528,20 +574,109 @@ impl Debug for Certificate {
    }
 }

+/// An identity that can be used with [`TlsParametersBuilder::identify_with`]
+#[allow(missing_copy_implementations)]
+pub struct Identity {
+    #[cfg(feature = "native-tls")]
+    native_tls: native_tls::Identity,
+    #[cfg(feature = "rustls-tls")]
+    rustls_tls: (Vec<CertificateDer<'static>>, PrivateKeyDer<'static>),
+    #[cfg(feature = "boring-tls")]
+    boring_tls: (boring::x509::X509, PKey<boring::pkey::Private>),
+}
+
+impl Debug for Identity {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Identity").finish()
+    }
+}
+
+impl Clone for Identity {
+    fn clone(&self) -> Self {
+        Identity {
+            #[cfg(feature = "native-tls")]
+            native_tls: self.native_tls.clone(),
+            #[cfg(feature = "rustls-tls")]
+            rustls_tls: (self.rustls_tls.0.clone(), self.rustls_tls.1.clone_key()),
+            #[cfg(feature = "boring-tls")]
+            boring_tls: (self.boring_tls.0.clone(), self.boring_tls.1.clone()),
+        }
+    }
+}
+
+#[cfg(any(feature = "native-tls", feature = "rustls-tls", feature = "boring-tls"))]
+impl Identity {
+    pub fn from_pem(pem: &[u8], key: &[u8]) -> Result<Self, Error> {
+        Ok(Self {
+            #[cfg(feature = "native-tls")]
+            native_tls: Identity::from_pem_native_tls(pem, key)?,
+            #[cfg(feature = "rustls-tls")]
+            rustls_tls: Identity::from_pem_rustls_tls(pem, key)?,
+            #[cfg(feature = "boring-tls")]
+            boring_tls: Identity::from_pem_boring_tls(pem, key)?,
+        })
+    }
+
+    #[cfg(feature = "native-tls")]
+    fn from_pem_native_tls(pem: &[u8], key: &[u8]) -> Result<native_tls::Identity, Error> {
+        native_tls::Identity::from_pkcs8(pem, key).map_err(error::tls)
+    }
+
+    #[cfg(feature = "rustls-tls")]
+    fn from_pem_rustls_tls(
+        pem: &[u8],
+        key: &[u8],
+    ) -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>), Error> {
+        let mut key = key;
+        let key = rustls_pemfile::private_key(&mut key).unwrap().unwrap();
+        Ok((vec![pem.to_owned().into()], key))
+    }
+
+    #[cfg(feature = "boring-tls")]
+    fn from_pem_boring_tls(
+        pem: &[u8],
+        key: &[u8],
+    ) -> Result<(boring::x509::X509, PKey<boring::pkey::Private>), Error> {
+        let cert = boring::x509::X509::from_pem(pem).map_err(error::tls)?;
+        let key = boring::pkey::PKey::private_key_from_pem(key).map_err(error::tls)?;
+        Ok((cert, key))
+    }
+}
+
 #[cfg(feature = "rustls-tls")]
 #[derive(Debug)]
-struct InvalidCertsVerifier;
+struct InvalidCertsVerifier {
+    ignore_invalid_hostnames: bool,
+    ignore_invalid_certs: bool,
+    roots: RootCertStore,
+    signature_algorithms: WebPkiSupportedAlgorithms,
+}

 #[cfg(feature = "rustls-tls")]
 impl ServerCertVerifier for InvalidCertsVerifier {
    fn verify_server_cert(
        &self,
-        _end_entity: &CertificateDer<'_>,
-        _intermediates: &[CertificateDer<'_>],
-        _server_name: &ServerName<'_>,
+        end_entity: &CertificateDer<'_>,
+        intermediates: &[CertificateDer<'_>],
+        server_name: &ServerName<'_>,
        _ocsp_response: &[u8],
-        _now: UnixTime,
+        now: UnixTime,
    ) -> Result<ServerCertVerified, TlsError> {
+        let cert = ParsedCertificate::try_from(end_entity)?;
+
+        if !self.ignore_invalid_certs {
+            rustls::client::verify_server_cert_signed_by_trust_anchor(
+                &cert,
+                &self.roots,
+                intermediates,
+                now,
+                self.signature_algorithms.all,
+            )?;
+        }
+
+        if !self.ignore_invalid_hostnames {
+            rustls::client::verify_server_name(&cert, server_name)?;
+        }
        Ok(ServerCertVerified::assertion())
    }

--- a/src/transport/smtp/extension.rs
+++ b/src/transport/smtp/extension.rs
@@ -291,14 +291,8 @@ impl Display for RcptParameter {

 #[cfg(test)]
 mod test {
-
-    use std::collections::HashSet;
-
    use super::*;
-    use crate::transport::smtp::{
-        authentication::Mechanism,
-        response::{Category, Code, Detail, Response, Severity},
-    };
+    use crate::transport::smtp::response::{Category, Code, Detail, Severity};

    #[test]
    fn test_clientid_fmt() {
--- a/src/transport/smtp/transport.rs
+++ b/src/transport/smtp/transport.rs
@@ -336,11 +336,11 @@ impl SmtpClient {
        match &self.info.tls {
            Tls::Opportunistic(tls_parameters) => {
                if conn.can_starttls() {
-                    conn = conn.starttls(tls_parameters, &self.info.hello_name)?;
+                    conn.starttls(tls_parameters, &self.info.hello_name)?;
                }
            }
            Tls::Required(tls_parameters) => {
-                conn = conn.starttls(tls_parameters, &self.info.hello_name)?;
+                conn.starttls(tls_parameters, &self.info.hello_name)?;
            }
            _ => (),
        }
Author	SHA1	Message	Date
Paolo Barbolini	e8b2498ad7	Prepare v0.11.8 (#985 )	2024-09-03 15:43:04 +02:00
Paolo Barbolini	bf48bd6b96	ci: bump dependencies (#984 )	2024-09-02 17:37:44 +02:00
André Cruz	fa6191983a	feat(tls-peer-certificates): Provide peer certs (#976 ) Add a method that, when using a TLS toolkit that supports it, returns the entire certificate chain. This is useful, for example, when implementing DANE support which has directives that apply to the issuer and not just to the leaf certificate. Not all TLS toolkits support this, so the code will panic if the method is called when using a TLS toolkit that has no way to return these certificates.	2024-09-02 17:26:46 +02:00
Paolo Barbolini	ca405040ae	chore: replace manual impl of #[non_exhaustive] for InvalidHeaderName (#981 )	2024-08-29 05:43:23 +02:00
Paolo Barbolini	f7a1b790df	Make HeaderName comparisons case insensitive (#980 )	2024-08-29 05:43:14 +02:00
Paolo Barbolini	caff354cbf	chore: bump vulnerable dependencies	2024-08-23 09:28:21 +02:00
Paolo Barbolini	a81401c4cb	Fix latest clippy warnings (#979 )	2024-08-23 09:24:05 +02:00
Jonas Osburg	54df594d6c	Implement accept_invalid_hostnames for rustls (#977 ) Fixes #957 Co-authored-by: Paolo Barbolini <paolo.barbolini@m4ss.net>	2024-08-21 10:29:10 +02:00
Felix Rodemund	cada01d039	Add mTLS Support (#974 ) This adds support for mutual authentication to transport layer secured connections used to deliver mails. Client authentication requires the client certificate and the corresponding private key in pem format to be passed to Identity::from_pem. The resulting Identity needs then to be provided to TlsParametersBuilder::identify_with.	2024-07-30 21:28:34 +02:00
Paolo Barbolini	0132bee59d	Bump idna to v1 (#966 )	2024-06-11 18:12:49 +02:00
Paolo Barbolini	acdf189717	Fix clippy warnings (#967 )	2024-06-11 18:12:32 +02:00
Ilka Schulz	3aea65315f	resolve #806 : forbid empty forward path when deserializing address::Envelop (#964 )	2024-06-11 09:48:30 +00:00
Paolo Barbolini	9d3ebfab1a	Prepare 0.11.7 (#961 )	2024-04-23 16:04:19 +02:00
rezabet	6fb69086fb	style: Maintain message consistency (#960 )	2024-04-21 16:10:32 +02:00
Paolo Barbolini	dfdf3a61d2	Drop ref syntax (#959 )	2024-04-21 11:22:07 +02:00
dependabot[bot]	e30ac2dbff	Bump rustls from 0.23.3 to 0.23.5 (#958 ) Bumps [rustls](https://github.com/rustls/rustls) from 0.23.3 to 0.23.5. - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](https://github.com/rustls/rustls/compare/v/0.23.3...v/0.23.5) --- updated-dependencies: - dependency-name: rustls dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-04-21 10:28:08 +02:00
Paolo Barbolini	22dca340a7	Bump hostname to v0.4 (#956 )	2024-04-01 21:36:57 +02:00
Paolo Barbolini	c7d1f35676	Prepare 0.11.6 (#955 )	2024-03-28 16:19:10 +01:00
Paolo Barbolini	eebea56f16	Upgrade email-encoding to v0.3 (#952 )	2024-03-28 15:22:55 +01:00
Paolo Barbolini	851d6ae164	Bump license year (#954 )	2024-03-28 14:50:53 +01:00
Paolo Barbolini	6f38e6b9a9	Fix latest clippy warnings (#953 )	2024-03-28 05:12:13 +01:00
Paolo Barbolini	c40af78809	Prepare 0.11.5 (#951 )	2024-03-25 17:59:47 +01:00
Paolo Barbolini	6d2e0d5046	Bump rustls to v0.23 (#950 )	2024-03-22 20:09:27 +01:00