Cannot get XEP-0368 to pass compliance tester

Support apps
, ,
1

What app is this about, and its version: Prosody 0.12.4-ynh106
What YunoHost version are you running: 12.1.39 (stable)
What type of hardware are you using: Virtual machine

Describe your issue

I have Prosody and Jitsi Meet installed. As far as I understand it, I have the correct DNS records set up at the registrar and the correct configuration settings for my Prosody instance. However I cannot get the XMPP compliance tester to pass XEP-0368. Does anyone have any knowledge of how to set this up correctly or is this not possible with my current set up? Once thing I have discovered is that the certificate for the Jitsi Meet subdomain seems to be being presented instead of the root domain certificate where Prosody is installed.

Share relevant logs or error messages

openssl s_client -connect xmpp.example.com:5223 -servername example.com -alpn xmpp-client < /dev/null | openssl x509 -noout -subject -issuer
depth=0 C = GB, L = The Internet, O = Your Organisation, OU = XMPP Department, CN = meet.example.com, emailAddress = xmpp@meet.example.com
verify return:1
DONE
subject=C = GB, L = The Internet, O = Your Organisation, OU = XMPP Department, CN = meet.example.com, emailAddress = xmpp@meet.example.com
issuer=C = GB, L = The Internet, O = Your Organisation, OU = XMPP Department, CN = meet.example.com, emailAddress = xmpp@meet.example.com
2

XEP-0368 is mostly useful if you need to have your XMPP server reachable on port 443.
Implementing this in prosody_ynh app and/or jitsi_ynh app is not possible without making substantial changes in Yunohost core. So it’s not happening anytime soon unfortunately.

If you really want to enable it, you’ll have to do it manually. For this, I suggest you follow the instructions concerning nginx on the XEP-0368 page on XMPP wiki.

3

Ok, thanks for the tip.

4

If i remember correctly, the XEP-0368 can be fullfilled as soon as the SRV record “_xmpps-client” has been added, whatever the port listening on the server (usually 5223). According to https://compliance.conversations.im/test/xep0368/ , in 2024, most of the half of the known public servers (470/1037) were supporting this XEP, but very few (54/470) were listening on 443, which is probably the most usefull case when looking to by-pass firewalls.

I would be really interested to allow this to work on port 443 on Yunohost, but as said above it could require some heavy work on Yunohost side.

5

The SRV record is present and correct but the compliance tester reports XEP-0368 as failed.

6

Indeed, I opened a bug : Support XEP-00368 SRV records for XMPP over TLS · Issue #74 · YunoHost-Apps/prosody_ynh · GitHub

7

Thank you