interop - 2010-12-07

mattj :-)

quiet interop day today?

very

Does that mean that everything's fine or that stuff is horribly broken and everyone just sits an stares at the code?

:)

fippo, it would have saved me some time if you generated CSRs, but I can do it shortly if you're too lazy ;)

fippo, unless you happen to have a copy of the Prosody repo

in certs/ there's a Makefile

So, I think we need to initially get to the stage where every server is running up with a CA-generated cert for their domain.

make yourdomain.com.cnf, edit the generated file accordingly

then make yourdomain.com.csr

Once we're there, we can start testing basic s2s interop.

Indeed, but if I have to start generating CSRs for everyone who needs a cert then it means it's going to take twice as long :)

I can do it, if people send me the details

Dave's taking over mlinkrelease from me, btw.

k

fippo, it looks like I have a fix from Isode - did you say the CSR you sent was wrong anyway? or would it be fine for me to sign it now?

mattj: the csr I sent you was based on a old version and contained funny hostnames

fippo, aha, found why Prosody isn't advertising starttls

the CA stuff doesn't generate PEM by default

MattJ, While we were tinkering, we noticed that the CRL DP is mis-marked critical in end-user certificates, so you'll probably want to reissue those. :-(

(It's technically just about legal - breaking a SHOULD - but OpenSSL certainly rejects them)

Ah... ok

MattJ, That fix also fixes that issue. (Along with the other niggles and things you found).

mattj: openssl did not expect a DER ca certificate either :-)

:)

fippo, Or X.509 interop at least.

yai

i've added the ca location to the wiki page btw

Thanks

aren't CRLs normally provided via HTTPS? or are they already singed?

*signed

tobias: dave will explain that in a second :-)

Heh

CRLs are signed, so can be distributed by any mechanism. Location is explicitly or imi=plicity specified in the Cert. Usual distribution is either LDAP or HTTP. HTTPS is not really needed, although sometimes used

steve.kille: ahh..k..then it makes sense :)

Tobias, The only CA I've seen using https is CACert.org. The problem is, how do you verify the cert used in HTTPS, and if it fails to verify but the CRL is still signed (and within its expiry), what do you do anyway?

throw a coin

what do you do anyway if the resource of the CRL is unavailable

Tobias, Ah, then the certificate is unverifiable, so cannot be trusted.

Could be an attack on the CA to avoid disclosure of a revocation.

Tobias, But that's why I personally prefer OCSP stapling, which largely avoids that case. But we don't support that. (yet?)

MattJ, Do we need to resend CSRs?

badlop: is ejabberd21 already tls-enabled?

tls not enabled; what cert should i install in it?

badlop, If you generate a CSR, then MattJ has the CA, and can issue you a cert.

badlop, http://ca.xmpptest.com

prosody has a really nice makefile for generating csrs

fippo, Sodium is rather spiffy, too. Like Prosody's makefile, as I understand things, it generates the CSR from the configuration.

Interop day 2: We made mattj sign CSRs all day

Dave Cridland: not yet, but I have a prosodyctl patch that makes it spit out a SAN section for a openssl.cnf :)

what's his email address?

ah, mwild1@gmail.com

are we working on email interop? :)

we need a way to attach files to a MUC room....

stpeter, What, send the CSRs via MUC?

yeah..since normal p2p filetransfer already works that nice :P

attach to the room

if you wanted to have it available to all

Tobias: heh, well, I just received a file from someone outside Cisco and it all worked fine, but it's not as reliable as it should be :(

mod_pastebin!

:)

stpeter, Yeah, one of our (XMPP) partners sent me a file. Surprised the heck out of me that it worked.

Bah, XMPP is a messaging protocol, not a file-sharing protocol!

;)

At least the Pontari.us guys are trying to make it a media sharing network, too.

<fippo> i've added the ca location to the wiki page btw <-- and i added instructions to build the CSR

Kev, Can you do some DNS magic for me?

Kev: if you're incrementing the serial anyway, cann you add a no.such.xmpptest.com srv record pointing to . (which iirc means: no such service)

fippo, Oh, nice thought.

Kev, In that case, also add an A record pointing somewhere interesting we can log.

Kev, When you're back, then, I have 217.155.137.58 (5222/5269) servicing mlinkrelease.xmpptest.com - feel free to give it a random hostname, like, say, mlinktrunk.xmpptest.com. :-)

It'll wait until tomorrow, I expect :)