Are XMPP certificates different than “regular” ones

ejabberdssl-certificatexmpp

StartSSL offers special XMPP certificates in addition to their "regular" web server certs. Can anyone tell me if XMPP certificates are special in any way? Isn't it possible to operate an ejabberd with a regular certificate? StartSSL was unfortunately unable to answer my question (they only claimed one needs an XMPP certificate for a Jabber server). 🙁

Cheers,
Sebastian

Best Answer

These are a little tricky to find out on the internet - hopping randomly through the "StartSSL" marked ones in this public directory, some were using self-signed certificates, and others were using the same certificates as on their HTTP services (not an "XMPP" cert).

Of the couple that I did find using these special XMPP certs, there were two differences that appear to be significant:

  • The Enhanced Key Usage didn't include Client Authentication (1.3.6.1.5.5.7.3.2), only Server Authentication (1.3.6.1.5.5.7.3.1).
  • Subject Alternative Names included XmppAddr (1.3.6.1.5.5.7.8.5) and SRVName (1.3.6.1.5.5.7.8.7) name(s).

Given that these certificates seem to be rarely used, it doesn't seem likely that having these extra alt names actually matters in many (or any?) XMPP implementations... but there you go, those are the differences.

Related Topic