jdev - 2020-03-02

defanor, the certificate should be valid for the JID’s domain, if there is no other trust chain.

Because otherwise someone who can poison your DNS could point your-domain.example to evil.com and trivially obtain a certificate for evil.com.

Indeed. Thanks.

Another trust chain in wide use is DNSSEC, if you sign the SRV record as well as a TLSA on the target domain, a client can use it.

(I’m not sure any client does, though)

for certain, not widely used values of "wide use"

I think Conversations does

All clients *should* though

(wrong window) ✏