Every server certificate in the environments had expired (May 2025 for
federation, November 2025 for the xmpp.localhost.example domain,
September 2026 for otherxmpp), so certificate-authenticated S2S
(SASL EXTERNAL) failed with a TLS certificate_unknown alert.
The truststores came from a 2017 bundle, or for federation from
Openfire's 2023 bundle. Both still trusted roots that Mozilla has since
removed after distrust decisions (Entrust, Camerfirma, TURKTRUST and
others). They are rebuilt from Mozilla's current CCADB root list, the
same source Openfire's build/updateTLSTruststore uses.
The 2024 truststore refresh for federation dropped the peers' self-signed
certificates that the federation README describes, and the
cluster_with_federation stores trusted only the old certificates. Each
federated truststore now trusts its peer's new certificate.
scripts/update_certificates.sh makes this repeatable. The self-signed
certificates are valid for ten years because they only serve this lab.
The shared xmpp.localhost.example certificate now also names
xmpp2/xmpp3.localhost.example, the hostnames of the other cluster
nodes.
- Unified structure for auto-loading plugins for different modes of operation
- Added in heapdump/monitoring/jsxc plugins for auto-loading
- Modified scripts to work with (docker compose 2) default of using hyphens for creating service names
- Fixed copy monitoring plugin script and added copy hazelcast plugin script
- Extra scripts for blocking and unblocking server 2 in federation mode
Openfire 4.7.0 brings a change to the name of the log files. They've been renamed from 'all.log' to 'openfire.log'.
This commit applies the same change to this project.
New self signed certs for the other domain.
Pull in all log files with get_logs.
Co-authored-by: Emiel van der Herberg <emiel.van.der.herberg@marviq.com>
Matthew Vivian
Dan Caseley
Emiel van der Herberg
Guus der Kinderen
Emiel van der Herberg