Hi all (sorry for such wide conference, but I am sure it will be valuable),
hope that there are many experienced admins/developers on these lists
and many of you probably running certificates signed by your own CA on
your Jabber servers too.
After some experiences during last months I feel it would be great to
discuss the use of certificates signed by 'non-public' CA on the public
services.
We already had some 'excessive' discussion about it with Peter
Saint-Andre this year and didn't 'solve' it. The only outcome of it was
that the Jabber.sk service is still not listed in the list of public
services and the only reason is that it's using certificate signed by
our internal CA. I did accept that and gave Peter more time to think
about it as it doesn't harm our service at all.
Nevertheless I just discovered that Google started to reject retrieval
of emails from the POP3s and IMAPs servers which use the certificates
from non-public CAs [1]. Unfortunately they didn't provide the list of
CAs they accept (just mentioned Mozilla foundation's list) and still
allow to retrieve these emails by not-secured POP3/IMAP channels and
propose it as an workaround. It is probably planned and has to do
something with the new rules of Google Apps, which are not for free
anymore. But this has nothing with XMPP.
The second issue I was fighting with (and not only once) is that
OpenFire jabber server doesn't accept message retrieval over s2s
connection with the jabber server using the certificate signed by
'non-public' CA by default. Hopefully there is a chance to change this
behavior.
Now let me fall into the situation with SSL certificates in the XMPP
world in more details.
Just some months before (and it looks like that also these times) the
CACert wasn't recognised as an publicly trusted CA by Mozilla foundation
[2] (Opera and many more too) because they didn't pass their auditing.
But at those times almost all of the jabber servers and clients already
accepted certificates signed by them as 'secure'. Looks like that XMPP
foundation proposal to use CACert as one of the possible CAs was the
only argument for acceptance. The developers of jabber software usually
do not take care about any security requirements which the CA has to
pass before it will be added to the list of 'secure' public CAs they do
recognise. I just checked more support requests for Gajim [3,4] and
other jabber clients with requests to add CACert or other CA into the
list of accepted CAs and nobody of the developers asked or checked the
state of the CA and the issue the CA has with this process in other
projects or at least didn't mentioned that in the support requests.
I think that this restriction of use only publicly acceptable CAs for
SSL/TLS communication is not correct in general and should not be
enforced by Google, XMPP foundation or OpenFire or anybody else. The
possible solution for this situation in XMPP world could be to provide
the list of acceptable and secure CAs by XMPP foundation directly. It
could maintain and provide this list for all XMPP developers. As a part
of this solution there should be defined the process with clear
requirements to CA willing to be added to this list.
I will accept that the jabber.sk is not added to the list of public
services just after this will be addressed and there will be some clear
statement made by XMPP foundation and/or the public XMPP service list
maintainers.
As another argument for advocating of the private CAs to be accepted on
XMPP servers I would remind you that XMPP network is presented as free
and open and we should take care of not stealing it's openness and freedom.
I would like to give a chance to run any XMPP server with certificates
signed by their private CA without any messages rejection. Of course
there is nothing what doesn't allow me to request the sign of my
certificate by CACert or other CA and probably pay some price for it.
This is just my choice and I am asking if XMPP 'world' is ready and able
to accept that as I do not see any advantage of publicly accepted CAs in
XMPP network at this time.
There is also other possibility to limit such issues with not accepted
connections due to certificate rejections - ask developers of all
mainstream XMPP software (server and client) to add CA into their lists.
But I do not find it as an appropriate and correct solution and would
like to open wide discussion about it instead.
Appreciate all meaningful posts in advance. (sorry for my English)
[1]
http://support.google.com/mail/bin/answer.py?hl=en&hlrm=en&ctx=gmail&answer=21291#strictSSL
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=215243#c158
[3] https://trac.gajim.org/ticket/3329
[4] https://trac.gajim.org/ticket/5569
Best regards,
--
Peter Viskup
admin of one small public jabber.sk
