0d1c00691d
Every server certificate in the environments had expired (May 2025 for federation, November 2025 for the xmpp.localhost.example domain, September 2026 for otherxmpp), so certificate-authenticated S2S (SASL EXTERNAL) failed with a TLS certificate_unknown alert. The truststores came from a 2017 bundle, or for federation from Openfire's 2023 bundle. Both still trusted roots that Mozilla has since removed after distrust decisions (Entrust, Camerfirma, TURKTRUST and others). They are rebuilt from Mozilla's current CCADB root list, the same source Openfire's build/updateTLSTruststore uses. The 2024 truststore refresh for federation dropped the peers' self-signed certificates that the federation README describes, and the cluster_with_federation stores trusted only the old certificates. Each federated truststore now trusts its peer's new certificate. scripts/update_certificates.sh makes this repeatable. The self-signed certificates are valid for ten years because they only serve this lab. The shared xmpp.localhost.example certificate now also names xmpp2/xmpp3.localhost.example, the hostnames of the other cluster nodes. |
||
|---|---|---|
| .. | ||
| cluster_block_node.sh | ||
| cluster_reset_blocking.sh | ||
| cluster_unblock_federation.sh | ||
| cluster_unblock_node.sh | ||
| copy_hazelcast_plugin.sh | ||
| copy_monitoring_plugin.sh | ||
| federation_block_federation.sh | ||
| get_logs.sh | ||
| peek_at_database.sh | ||
| pruneDataDirectoriesWithSudo.sh | ||
| update_certificates.sh | ||