diff options
| author | Kim Alvefur <zash@zash.se> | 2025-04-01 18:31:26 +0200 |
|---|---|---|
| committer | Kim Alvefur <zash@zash.se> | 2025-04-01 18:31:26 +0200 |
| commit | 126262edb30d67f15abd18097f28d9e0a5898ef9 (patch) | |
| tree | 72a592aebab590ca7609d4121c567f079c0296ef /plugins | |
| parent | d4af16441d839620e400eb79dc281085ee4ca096 (diff) | |
| parent | 7976f21e3e34f7ae1c46446dbed46115a66fa8a4 (diff) | |
| download | prosody-126262edb30d67f15abd18097f28d9e0a5898ef9.tar.gz prosody-126262edb30d67f15abd18097f28d9e0a5898ef9.zip | |
Merge 13.0->trunk
Diffstat (limited to 'plugins')
| -rw-r--r-- | plugins/mod_s2s.lua | 2 | ||||
| -rw-r--r-- | plugins/mod_tls.lua | 5 |
2 files changed, 5 insertions, 2 deletions
diff --git a/plugins/mod_s2s.lua b/plugins/mod_s2s.lua index 84ae34b5..7beab34a 100644 --- a/plugins/mod_s2s.lua +++ b/plugins/mod_s2s.lua @@ -999,7 +999,7 @@ local function friendly_cert_error(session) --> string local cert_errors = set.new(session.cert_chain_errors[1]); if cert_errors:contains("certificate has expired") then return "has expired"; - elseif cert_errors:contains("self signed certificate") then + elseif cert_errors:contains("self signed certificate") or cert_errors:contains("self-signed certificate") then return "is self-signed"; elseif cert_errors:contains("no matching DANE TLSA records") then return "does not match any DANE TLSA records"; diff --git a/plugins/mod_tls.lua b/plugins/mod_tls.lua index b240a64c..ac215b81 100644 --- a/plugins/mod_tls.lua +++ b/plugins/mod_tls.lua @@ -55,6 +55,7 @@ function module.load(reload) module:log("debug", "Creating context for c2s"); local request_client_certs = { verify = { "peer", "client_once", }; }; + local custom_cert_verification = { verifyext = { "lsec_continue", "lsec_ignore_purpose" }; }; local xmpp_alpn = { alpn = "xmpp-server" }; ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections @@ -67,7 +68,9 @@ function module.load(reload) module:log("debug", "Creating context for s2sin"); -- for incoming server connections - ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs); + ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", + host_s2s, host_ssl, global_s2s, request_client_certs, custom_cert_verification + ); if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end if reload then |