[jdev] S2S security with TLS certificates?

[Scott Cotton]

Hi all,

Another question from a newbie.   I'm interested to know any pointers or opinions about
using TLS certificates (with trust chains) as a means to authenticate the originator of an
incoming s2s connection.

In particular, is it considered a feasible policy for an xmpp server to accept
stanzas from an incoming s2s connection so long as the fqdn of the "from" attribute of
the stanza matches the common name of the incoming server's  certificate,
and that certifcate is valid and signed by a trusted  certificate authority?
(of course assuming all else is ok for accepting the stanza)

RFC3920 talks about certificate handling mostly in the client-to-server context,
and refers to an informational RFC (2818)  for  further information.  That document
also considers a client-server circumstance where the hostname (uri) is known to
the client ahead of time.  This does not seem the case when considering
an incoming server-server connection, in addition to the reversal of roles (receiving
end wants to authenticate initiating end).

Maybe I'm missing something (please do tell if so).  It seems like there should
be some sort of middle ground between SASL and dialback, since dialback is optional and SASL hard to coordinate for public federation.  Maybe policy w.r.t. TLS certificates or an SPF-like approach (see openspf.org), or requiring dialback for publicly federated servers would be of interest.

Best Regards,

--
scott