3 ms·
It is not pragmatic to design your protocol for web use cases when it's not the web.
by superkuh 8mo ago
It is not pragmatic to design your protocol for web use cases when it's not the web.
- bawolff 8mo agoUnless im missing something, this is a poor design full stop. How are they validating SAN on these client certificates?
- agwa 8mo agoXMPP identifiers have domain names, so the XMPP server can check that the DNS SAN matches the domain name of the identifiers in incoming XMPP messages. I've seen non-XMPP systems where you configure the DNS name to require in the client certificate. It's possible to do this securely, but I agree entirely with your other comment that using a public PKI with client certs is a recipe for disaster because it's so easy and common to screw up.
- account42 8mo agoOn the contrary, setting up a separate PKI for XMPP would be what is not pragmatic or even feasible at all. The pragmatic choice is to make use of the options available even if some people find them icky.