XMPP Service Operators - 2022-08-09

Establishing a secure connection from lebihan.pl to emevth.no-ip.biz failed. Certificate hash: f23518f572dd1897e6ae2a24b5aafeac630b06337e6ec6de30eac4a4a21d7ee4. Error with certificate 0: certificate has expired. Establishing a secure connection from lebihan.pl to conference.gajim.org failed. Certificate hash: ebcda38cd840bd2cb0e3e1623004b63481129107b44aa962ce4b122258a68528. Error with certificate 0: certificate has expired.

down with certificates

smooth_op: what do you replace them with

a firm handshake with eye contact

no blood pact?

lol. i wish there was a better way but free 3-month certs will have to do.

next step is 3-day certs

you joke

jonas’, https://www.rfc-editor.org/rfc/rfc8739.html

convergence of certificates and ocsp pretty much ✏

(have you ever noticed that it is *impossible* to type the acronym for Online Certificate Status Protocol correctly on the first try?)

Also when you get it wrong it's the acronym for some security certification

actually nice would be to have raw public keys and DANE stapling, but nice things are of course unavailable as usual

...until some consortium says even those keys need to be rotated every 3 months

and isn't dane+dnssec fighting a similar battle like ipv6? the Don't Break the Internet battle?

huh? unfavorable deployment characteristics of the "it won't work until everyone has it" sort, sure

ah yes I hate the evil consortium that solved TLS on the internet and made most of the net encrypted and usable

oh wait no I don't that would be ridiculous lol, you don't remember getting TLS certs before acme/letsencrypt? living nightmare

but only once per year!

once per year and then everytime you added a new domain, also no one could afford wildcards

don't forget needing to do SNI because you couldn't afford multi-domain certs

I don't remember SNI from that time

oh, what LE did for the internet was/is awesome. the catch was now we have to be 4 times as diligent

"just automate it"

Not really, now you set it up once and it's good forever

Vs forgetting the manual steps every year

dunno about you but dealing with certbot is a nightmare for me

because inevitably, certbot or cron stopped working but since we were smart and setup automation, we devoted less attention

"Hello, I am certbot and today I'm going to start putting your certs into example.com-0001 instead!"

I took one look at certbot, saw a pile of python, went with acme.sh and haven't had a problem since

I use getssl.sh, also no problem 🤷🏼‍♂️ Than a little bit of shell-magic and the right plugin in prosody to "curl" a msg if ssl-still-alive-time is less then 20 days. (Default ssl will be renewed if less then 30 days)

Who here operates this FXTIA bot which joined every room listed?

And what is its purpose?

me

Oh, since your JID said bot I thought you were a bot. ^^

Lunk Mauve check your PM