XMPP Service Operators - 2023-10-28

Establishing a secure connection to conference.siacs.eu failed. Certificate hash: 28f112735c956c229a4050c49a38f2c9da13ced3. Error with certificate 1: certificate has expired. Error with certificate 2: certificate has expired. Establishing a secure connection to conference.conversations.im failed. Certificate hash: 19ea0e3a6548a8a73c670cc64e36709851d1dcf7. Error with certificate 1: certificate has expired. Error with certificate 2: certificate has expired.

At least it is not mitm?! ✏

What happens on conversations.im?

See above...expired cert...now we wait...

Same with jabber.at

Maybe they updated CAA records last week but not tested?

jabber.at is back. yesterday they had cert problem

Probably everyone running to mitigate MITM issues

dsp3: this happens in cycles, as certs expire, something is not working in that automated way you've setup it ¯\_(ツ)_/¯

Yeah. Understood. Interesting coincidence it happened to conversations as well

Interestingly I get another error: Establishing a secure connection to conference.siacs.eu failed. Certificate hash: d926745ca77c1290bf9ccb27738621e2fb8d2e00e56272e8cd0760ffe9835568. Error with certificate 1: unable to get local issuer certificate.

I see the same ^^^

It's another hash, maybe direct tls port. Vs starttls port

I don't think it's a simple expiry, because it's expired 2021 what we see

More like a fallback cert that's somewhere on the the sever ✏

it isn't necessarily a different hash, just a different hash type, note the length

On conference.siacs.eu, testtls.com reports "certificate does not match supplied URI (same w/o SNI)"

Them people are looking into it...

Now I got it the cert is fine, but the intermediate cert is old for some reason. Needed the newest version of testssl.sh... Intermediate cert validity #1: expired! (2021-09-29 19:21). R3 <-- DST Root CA X3

dsp3: you must use it like this: ./testssl.sh -S -t xmpp-server --xmpphost conference.siacs.eu xmpp-hosting.conversations.im:5269 No SNI problem... "Only" the chain is broken

Establishing a secure connection from lebihan.pl to conference.siacs.eu failed. Certificate hash: d926745ca77c1290bf9ccb27738621e2fb8d2e00e56272e8cd0760ffe9835568. Error with certificate 1: unable to get local issuer certificate. Establishing a secure connection from lebihan.pl to conference.conversations.im failed. Certificate hash: 44c4dafeb451bb81491e9f37df51e33680190443a8103ba4e94b565e74cef39e. Error with certificate 1: unable to get local issuer certificate.

Got that 3h ago

We all did

> dsp3: you must use it like this: > ./testssl.sh -S -t xmpp-server --xmpphost conference.siacs.eu xmpp-hosting.conversations.im:5269 > No SNI problem... "Only" the chain is broken Yeah, I was just testing on 443 as I presumed same cert used by all services to see if there was a general problem ↺

I have a question for https://certwatch.xmpp.net/, I did upgrade to bookworm, and afterwards did a cert renewal via certbot for my server - when I now try to access certwatch I am getting gateway time-out (might be independant from the upgrade) .... Is this known? ✏

You can't load the certwatch website?

what is the **** website?

504 Gateway Time-out nginx/1.18.0

getting that

https://certwatch.xmpp.net/servers

after entering my servername

mirux: certwatch is made with which language? maybe u are reverse proxying to the wrong socket (after a version upgrade, your nginx setup can be pointing to the old version number, this is common on php-fpm environments)

no proxy on my side

go

no clue where/what to check ....

It is working just fine for me.

any module I need to check on my side?

mirux, are you blocking tor?

nope, it went ok yesterday, my server is/was registered, only change is bookwork upgrade

That service had some hiccups, just try later

ok, the pubsub subscription stats I am registered

> It is working just fine for me. for me too ↺

error message is socks connect tcp localhost:9050->[MYIPV6]:5222: unknown error general SOCKS server failure

or

504 Gateway Time-out nginx/1.18.0