Client certificates

[sander]

Support for client certificates would be cool. AFAIK there
is no server yet that supports this, but it would become a very
interesting feature once there are such servers. With a client
certificate, the server verifies the certificate of a client before it
allows a connection. If the certificate is invalid or revoked, the
connection is aborted before it even is established.

This feature could be very useful in a scenario to prevent abuse:
1) The server admin sells self-signed client certificates for his
server for a very small amount (micro payments)
2) The server only allows connections from clients that have a valid certificate
3) If people want multiple account they have to buy more certificates
4) If people start to abuse the server (e.g. spam), the server admin
simply revokes their certificate(s) so that it becomes invalid. No
connection can be made with that certificate any more.
5) In order to connect again to the server, the abuser would have to
buy a new certificate.

--> Advantages:
1) Good users only have to pay a small one-time fee to get a reliable
spam-free service
2) Admins get a small source of funding to pay the hosting bill
3) Bad users who need to have multiple accounts, need to buy multiple
certificates *and* their certificates get revoked so that they have to
pay new ones-->Abuse gets very expensive!

[sander (s-devrieze)]

Related: http://coccinella.im/node/239

[Nicolas (nicolasfr)]

In fact there is at least one server which supports client certificates:
Openfire is a Jabber server which supports client based SSL authentication:
http://www.igniterealtime.org/projects/openfire/index.jsp

The latest spark client (beta 2.6.0 - java, open source) from the same company supports this feature.

I believe OS X iChat Server (based on jabberd?) also supports client based SSL authentication (I will do some tests in the next weeks).

[buzzdee (sebastia)]

svn revision #2797 implementing the client side server certificate verification, see bug #551811 should also contain the stuff to enable server side client certificate verification.
The user can specify client certificate and key, to be sent to the server, in order to verify the client.

Still needs to be tested, unfortunately ejabberd doesn't seem to provide such a feature.
openfire is installed, still need to figure out how to configure openfire to enable client certificate checks ;)

Is there another server implementation supporting client certificate verification?

[buzzdee (sebastia)]

I seem to have some problems with the java jce getting openfire to accept my certiifcate on openbsd, but I saw, jabberd2 has a patch applied some days ago, that also enabled client certificate validation:

https://bugs.launchpad.net/jabberd2/+bug/405233

[buzzdee (sebastia)]

XEP-0178: Best Practices for Use of SASL EXTERNAL with Certificates
http://xmpp.org/extensions/xep-0178.html

[buzzdee (sebastia)]

Also, the trunk version of gajim also supports sasl-external now: http://trac.gajim.org/ticket/5704, will wait for an updated version to try against a demo server:
-------------
We have a demo server at xmpp.rhizomatik.net running jabberd with this patch. (note: I commented out the CRL checking). A tutorial and some utils for the cert generation can be found here, as long a debian lenny backported package:

https://rhizomatik.net/myceliafoafssl/wiki/XmppFoafSSL . There is also a django app that handles user registration and cert generation (a bit insecure now, since the client key generation is done server side).
-------------

[buzzdee (sebastia)]

on OpenBSD -current, gajim is at version 0.14, so I can check how it works with gajim, to see what coccinella still missing here.