I am using K-9 Mail on Android and have set the SSL option to 'SSL (strict)'.
My understanding is that with this option K-9 definitely requires a valid SSL certificate which is issued by a trusted CA, i.e. no self-signed certificates.
What I am wondering about is whether K-9 actually evaluates the CN field in the certificate, i.e. whether it only accepts a certificate as valid and trusted if the CN and the mail server's DNS name match. This is IMO a fundamental requirement in order to not fall for MITM attacks. If K-9 did not match those, in the worst case K-9 would accept any (wildcard) certificate presented on the condition that is has been signed by a trusted CA.
Has anyone tested/confirmed/verified that this is not the case?