From 346f58c9d9fe2e876a140cce1763c585a6f1bdb0 Mon Sep 17 00:00:00 2001 From: Kim Alvefur Date: Sat, 15 Feb 2025 00:19:01 +0100 Subject: [PATCH] core.certmanager: Move LuaSec verification tweaks to mod_s2s These two settings are only really needed for XMPP server-to-server connections. --- core/certmanager.lua | 4 ---- plugins/mod_s2s.lua | 8 ++++++++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/core/certmanager.lua b/core/certmanager.lua index 9e0ace6a9..1c9cefed9 100644 --- a/core/certmanager.lua +++ b/core/certmanager.lua @@ -189,10 +189,6 @@ local core_defaults = { single_ecdh_use = tls.features.options.single_ecdh_use; no_renegotiation = tls.features.options.no_renegotiation; }; - verifyext = { - "lsec_continue", -- Continue past certificate verification errors - "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates - }; curve = tls.features.algorithms.ec and not tls.features.capabilities.curves_list and "secp384r1"; curveslist = { "X25519", diff --git a/plugins/mod_s2s.lua b/plugins/mod_s2s.lua index 8eb1565e3..84ae34b5a 100644 --- a/plugins/mod_s2s.lua +++ b/plugins/mod_s2s.lua @@ -1097,6 +1097,10 @@ module:provides("net", { -- FIXME This only applies to Direct TLS, which we don't use yet. -- This gets applied for real in mod_tls verify = { "peer", "client_once", }; + verifyext = { + "lsec_continue", -- Continue past certificate verification errors + "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates + }; }; multiplex = { protocol = "xmpp-server"; @@ -1111,6 +1115,10 @@ module:provides("net", { encryption = "ssl"; ssl_config = { verify = { "peer", "client_once", }; + verifyext = { + "lsec_continue", -- Continue past certificate verification errors + "lsec_ignore_purpose", -- Validate client certificates as if they were server certificates + }; }; multiplex = { protocol = "xmpp-server";