SSL certificate used by dukgo.com XMPP-server untrusted? [answered]
asked 2014-12-18 15:28:49 +0200
I have been using dukgo.com XMPP-server for about a year now without big problems. I haven’t had "ignore SSL errors" checked before. Now I have to have it checked for my account to connect. I tested it using mc-tool on terminal. More about that here.
The current certificate for duck.co seems to have been issued on December 2nd. That’s about the same time when my problems started.
The question is: Is the new certificate untrusted on Jolla and why?
Sorry. I’m a newbie when it comes to SSL certificates.
Are there some workarounds for adding that certificate myself? I feel that it’s unsecure to ignore all SSL errors.
The same account works without any problems on my PC with KDE Telepathy.
I am using Sailfish 1.1.0.39.
Have a look at https://together.jolla.com/question/2949/where-can-i-add-a-system-ca-certificate/ for instructions for adding adding a certificate for OpenSSL (and XMPP). If you'd like to use it with the browser too, see https://together.jolla.com/question/835/browser-personal-certificates-import/.
lechris ( 2014-12-18 15:58:33 +0200 )editI think they changed the Root CA, but I tried adding my dukgo account (magullo@dukgo.com) and it worked without problem. As far as I can see I am not online now, but no certificate complaints on 1.0.8.
magullo ( 2014-12-18 16:21:05 +0200 )edit@lechris I already saw that post but I don’t know which certificate I should add there.
Shadow ( 2014-12-18 18:45:17 +0200 )edit@magullo Ok. I am using Sailfish 1.1 (Uitukka). I don’t see any complaints either, but I cannot connect without the "ignore SSL errors" option. I tested it in terminal with mc-tool. See more about that here.
So, what root certificate should I add in Jolla?
Shadow ( 2014-12-18 18:47:42 +0200 )edit@Sami-Perkele I had a XMPP server with a self-signed certificate and fetched it directly using
lechris ( 2014-12-18 20:11:10 +0200 )editopenssl s_client -starttls xmpp -showcerts - connect example.com:5222 < /dev/null | openssl x509 -outform PEM > example.pemand added this one in/etc/pki/tls/certsas described by the other question.