I'm not sure how much it makes sense, but wanted to get some more opinions on the matter, because otherwise it will just continue rattling around my head.
HTTP Strict Transport Security (HSTS) is a mechanism that allows a HTTPS server to inform the browser to never allow unencrypted (or encrypted with an invalid certificate) connections to the domain. This is especially useful on the web because 1) users rarely type the protocol part of URIs 2) browsers can't default to HTTPS because so many sites don't support it. The advantages are less clear for XMPP. We already know if the other end supports encryption or not. However rarely is certificate authentication strongly enforced on the general network, for reasons we already well know. I wondered if a flag in stream negotiation could be used to inform the connecting party that the server intends to always have a valid certificate, and certificate authentication should be enforced for that domain. Prosody for example allows enforcing certificate authentication for some domains, but this is a manual process. Could it be made automatic? Is a HSTS-like flag even needed? (once a valid cert, always a valid cert?) Regards, Matthew
