Comment 1 for bug 551811

Revision history for this message
buzzdee (sebastia) wrote :

This bothered me since a long time, and it turned out implementing it was easier than anticipated ;)

svn version #2797 adds the check of the servers certificate.

How does it work:
1. in the Preferences, General, Network, Certificates Tab
   - activate the ckeckbox "TLS CA certificate file"
   - Browse to your CA certificate file (The certificate file should contain the whole certificate chain, from the Root CA, down to the CA that signed the server certificate.)

2. when login to the server either using TLS/SASL or SSL, and coccinella verified the Server certificate, then the connection to the server will be established, and the icon in the roster indicating the security of the connection turns green ;)

3. If the server certificate cannot be verified from Coccinella, then the connection to the server will fail, it will NOT fall back to a medium secure connection. If you do not want to verify the server certificate, then disable the checkbox option in the preferences.

Also the patch that was checked in to svn revision #2797 is attached for review. As this is a security related feature, intensive testing is necessary. So PLEASE TEST

Tested against ejabberd 2.1.3 using TLS/SASL and SSL connections.