* masarati@aero.polimi.it [2010-01-24 19:14:02 +0100]:

I'm applying the fix, please test.

I'm in production with the fix (on 2.4.11; I don't have the time to deploy HEAD right now). syncrepl (which is what I'm using SASL EXTERNAL for) now works again.

As for the need to validate the certificate: shouldn't this have been taken care of during the preceding TLS handshake?