Mercurial > prosody-wiki
changeset 451:171663daa144
mod_s2s_auth_fingerprint: remove info about pinning, this is the default now
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Sun, 27 Apr 2014 03:39:53 +0200 |
| parents | 042161223488 |
| children | 416ec6673229 |
| files | mod_s2s_auth_fingerprint.wiki |
| diffstat | 1 files changed, 6 insertions(+), 9 deletions(-) [+] |
line wrap: on
line diff
--- a/mod_s2s_auth_fingerprint.wiki Sun Apr 27 03:39:13 2014 +0200 +++ b/mod_s2s_auth_fingerprint.wiki Sun Apr 27 03:39:53 2014 +0200 @@ -3,16 +3,10 @@ = Introduction = -This module allows you to explicitly say that you trust remote servers if they show a certificate with a known fingerprint. -This is useful if you have many connections to servers that use self-signed certificates. +This module allows you to manually pin certificate fingerprints of remote servers. = Details = -In the default mode, the module will only mark connections as trusted *if* their certificate matches one of the fingerprints listed. -If it doesn't match, the status of the standard PKIX and identity validation is preserved. -Thus it is easy to switch from a self-signed certificate to a CA-signed certificate. - -The module has an optional mode in which it will reject listed servers that don't match one of the listed fingerprints, aka certificate pinning. Servers not listed in the configuration are not affected. = Configuration = @@ -28,10 +22,13 @@ "CF:F3:EC:43:A9:D5:D1:4D:D4:57:09:55:52:BC:5D:73:06:1A:A1:A0"; }; } + +-- If you don't want to fall back to dialback, you can list the domains s2s_secure_domains too +s2s_secure_domains = { + "jabber.org"; +} }}} -To enable certificate pinning mode, set {{{s2s_pin_fingerprints = true}}} - = Compatibility = ||trunk||Works||