Holger Weiß

In case you're using the official ejabberd packages on Debian stable: They're affected by a recent CA policy change (e.g., Let's Encrypt), causing ejabberd to reject newly issued certificates and thereby breaking federation with some remote servers. Deploy this update to fix the issue:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128568#23

You may also want to consider enabling mod_s2s_dialback to deal with remote servers that haven't been updated yet.

#ejabberd #XMPP #Jabber #Debian #LetsEncrypt

@Monal@fosstodon.org Yes.

I think the main scenario that certificate authentication protects against but Dialback does not looks like this:

• Alice exchanges messages with a remote contact, Bob.
• Those messages aren't E2E-encrypted/-verified.
• The attacker cannot MitM Alice's c2s connection.
• The attacker cannot MitM Bob's c2s connection.
• The attacker has no access to the remote server's certificate/key.
• DNSSEC is not deployed for the relevant domain(s).
• The attacker cannot MitM the (multi-perspective) DNS traffic used for issuing a new certificate.
• But the attacker can MitM the DNS traffic used for Dialback.