XMPP Service Operators - 2026-03-03

> I've also heard reports indicating that chatterboxtown.us is rejecting new Let's Encrypt certificates. I am making my own certificate authority in response to google being able to control letsencrypt ↺

Using it between friends for TLS and ipsec transit mode, but I'm not sure if anyone here would be willing to install it even with it being namespace scoped

OK, I've now reported this at xmpp:support@muc.5222.de?join

>> I've also heard reports indicating that chatterboxtown.us is rejecting new Let's Encrypt certificates. > > I am making my own certificate authority in response to google being able to control letsencrypt How expensive is that? Or you talking self-signed CA certs?

I'm not sure there's much practical difference: running your own certificate authority means creating a self-signed certificate used to sign others, while using a self-signed certificate directly just uses that single certificate. In either case, you still have to convince peers to trust your chain: either the self-signed end-entity certificate or the self-signed root certificate.

I have no idea what Tom meant. I was thinking they were talking about buying their place in the internet CA Cartel with their own business unit.

That way, your signed entity would end up with all the other CA's in your OS. ✏

That's the thing Google/Mozilla have control over though

An XMPP CA ecosystem separate from the browser one is certainly not out of the question. In fact XMPP.net began life as a CA for XMPP servers.

Interesting.

But it's not a small task, to do it at scale securely

> That's the thing Google/Mozilla have control over though Which is why they are against DANE. ↺

wait what? Google has no control over DANE

Only on adoption of it, I think.

Did they not bail out on supporting DNSSEC or DANE in their platforms 12 or so years ago?

My memory is fucked, but I recall a time when Google was supporting DNSSEC somewhere, maybe even in their browser, then they removed it.

And you know, that DANE requires DNSSEC.

god if we have to hate things google has changed their mind on that's literally everything

OK true

But what control does Google have on DANE?

Apart from no longer implementing DNSSEC validation in the browser?

And obviously Let's Encrypt was a massive diversion. ✏

tom, you are better off using DANE.

> An XMPP CA ecosystem separate from the browser one is certainly not out of the question. In fact XMPP.net began life as a CA for XMPP servers. Wouldn't it be better to encourage adoption of DANE for authentication instead? ↺

yep, and until then LE works fine