Every server certificate in the environments had expired (May 2025 for
federation, November 2025 for the xmpp.localhost.example domain,
September 2026 for otherxmpp), so certificate-authenticated S2S
(SASL EXTERNAL) failed with a TLS certificate_unknown alert.
The truststores came from a 2017 bundle, or for federation from
Openfire's 2023 bundle. Both still trusted roots that Mozilla has since
removed after distrust decisions (Entrust, Camerfirma, TURKTRUST and
others). They are rebuilt from Mozilla's current CCADB root list, the
same source Openfire's build/updateTLSTruststore uses.
The 2024 truststore refresh for federation dropped the peers' self-signed
certificates that the federation README describes, and the
cluster_with_federation stores trusted only the old certificates. Each
federated truststore now trusts its peer's new certificate.
scripts/update_certificates.sh makes this repeatable. The self-signed
certificates are valid for ten years because they only serve this lab.
The shared xmpp.localhost.example certificate now also names
xmpp2/xmpp3.localhost.example, the hostnames of the other cluster
nodes.
This updates the configuration to use a SNAPSHOT build of the Hazelcast plugin 5.5.0-1, and updated its configuration files accordingly.
Note that this requires Openfire (the container) to use Java 17 or later.
This adds support for IPv6, by giving all `start.sh` scripts an `-6` argument, that causes a dualstack configuration to be loaded.
Each individual docker-compose file has been split out. Now, each file no longer defines any networking. Instead, one of two networking fragments is expected to be merged in.
When starting Openfire, a Hazelcast configuration option is passed through to the Openfire process to denote preference for IPv4 or IPv6. This passing through depends on the change in Openfire, that is introduced by 2634d4a83a
Minor other changes have been applied, that mostly make the start scripts more consistent amongst each-other.
fixes#61
Matthew Vivian
Guus der Kinderen
Dan Caseley