XMPP Service Operators - 2021-11-15

Licaon_Kter https://xmpp.net/result.php?domain=convorb.im&type=client

edhelas: do explain why that's like that ✏

https://blog.windfluechter.net/2021/09/29/letsencrypt-ca-chain-issues-with-ejabberd/

The cert is valid, there's an issue with xmpp.net, right?

you have to change your certificate keychain, the one you're using is not trusted by some clients/servers

Yes, don't rely on xmpp.net for cert validation

Except that line I see no issue being mentioned in the report edhelas

edhelas: not my fault those old systems can't cope.

¯\_(ツ)_/¯

edhelas, is your server running Ubuntu? Is the ca-certificates package up to date?

> 2021-11-15 10:57:40.899 [warning] <0.16550.121>@ejabberd_s2s_in:handle_auth_failure:200 (tls|<0.16550.121>) Failed inbound s2s EXTERNAL authentication convorb.im -> movim.eu (::ffff:85.186.135.101): certificate has expired

Maybe the cert ecosystem moved already? :)) ✏

Licaon_Kter, lol

edhelas: my ISRG X1 intermediate cert has not expired, so that's FUD :) ✏

I'vz manually removed DST Root CA X3 from the chain to fix it on my side

That did not help...afaics ✏

https://xmpp.net/result.php?domain=movim.eu&type=client

I moved from T to A (and users were able to login again on some clients)

to me that was the fix, but I might be wrong

edhelas: which OS&version? I think I've asked this before multiple times, maybe I've missed the answer ✏

edhelas: compare the two reports, so yours is *great* with DST in thu chain but mine is *bad* without DST? Logic? ✏

edhelas: compare the two reports, so yours is *great* with DST in the chain but mine is *bad* without DST? Logic? ✏

Removing DST Root CA X3 from the chain will break compatibility with clients that dont trust ISRG X1. Especially Android 6 and below. Just saying. 😅

The issue is not related to movim.eu's cert anyway

Julian: DST is expired so not trusted, there on 6/7 they need to import the cert

It is expired, but still served as part of the default chain. LE will by default give you the chain "leaf > ISRG > DST". Thats intendet because some clients ignore the validity date of root certs (e.g. old androids).

Oh fuuuu

Licaon_Kter, and it should also not be a problem, unless with certain broken validators which stop at the first chain they find

edhelas: yes, I do get your messages, 'test', but I can't reply :) Will nuke Movim Android asap too ✏