Every server certificate in the environments had expired (May 2025 for
federation, November 2025 for the xmpp.localhost.example domain,
September 2026 for otherxmpp), so certificate-authenticated S2S
(SASL EXTERNAL) failed with a TLS certificate_unknown alert.
The truststores came from a 2017 bundle, or for federation from
Openfire's 2023 bundle. Both still trusted roots that Mozilla has since
removed after distrust decisions (Entrust, Camerfirma, TURKTRUST and
others). They are rebuilt from Mozilla's current CCADB root list, the
same source Openfire's build/updateTLSTruststore uses.
The 2024 truststore refresh for federation dropped the peers' self-signed
certificates that the federation README describes, and the
cluster_with_federation stores trusted only the old certificates. Each
federated truststore now trusts its peer's new certificate.
scripts/update_certificates.sh makes this repeatable. The self-signed
certificates are valid for ten years because they only serve this lab.
The shared xmpp.localhost.example certificate now also names
xmpp2/xmpp3.localhost.example, the hostnames of the other cluster
nodes.
0d1c00691d