XMPP Service Operators - 2025-12-27

MattJ, i'm trying to send you a private message but it's not going through

I see more and more letsencrypt certs that have: Client Authentication: optional CA List for Client Auth: {(some long long list)} My own certs are: Client Authentication: optional CA List for Client Auth: _empty_ Does anyone know when letsencrypt will add this long listx and what it will do? My idea would be, that xmpp servers that still validate client-Auth won't work with these certs if they are not one of the domain that is listed in that long long list? That list contains entries like C=ES,O=ACCV,OU=PKIACCV,CN=ACCVRAIZ1 OU=AC RAIZ FNMT-RCM,O=FNMT-RCM,C=ES

Menel, I think that's not a property of the certificate.

Instead, it's something applications configure in their (TLS) handshake. ✏

I faintly remember something about having to pass the list to some library or to some server for client authentication to work... so it's entirely possible that you're seeing a rollout of some change in some server's or client's TLS config through the ecosystem.

Ah I see. That makes sense, since it would be a bit much to press all that info into a cert.

also it is independent of the cert.

it's basically a statement of the server "hey, these are the CAs I accept client certificates of"

it's supposed to help the client choose the correct client certificate

it's also a mostly irrelevant feature in the XMPP world

(it matters more in corporate contexts where you may have multiple special-purpose CAs for different services)

Yes. I wonder now why ejabberd started to implement that now (or it is testssl.sh only showing it now)

as I said… I do remember that I had to do this for interop with some implementation, but I don't remember which it was.

possibly M-Link or Tigase.

prosody and xmpp-proxy at least just ignore whether that flag is set entirely, hopefully the newer ejabberd patch does the same

moparisthebest, we're not talking about the client auth flag which is part of the certificate AFAICT

what I mean is, I suspect that list only matters when the flag is set, and things that entirely ignore whether the flag is set also entirely ignore any list