Dear Maintainer,


I tried to connect to a fresh prosody installation, with a correct
certificate for the account ids.

Since I didn't have SRV records set up yet, I used the 'Advanced'
tab to set 'Connect server' to the name of the new server
(eg server.example.com), which is different from the domain in my
id (eg richard@example.com).

On enabling the account, pidgin reported a failure to verify the
certificate - because it was trying to validate 'server.example.com'
instead of the correct 'example.com'.

This problem seems to go away if the SRV records are supplied, and the
explicit connect server is left empty.

Bug #723155 may or may not be related or even the same bug; I couldn't
tell.

Thanks,
Richard

Are you sure this isn't intended behavior? Why should pidgin trust the
hostname on a certificate just because it matches the ID? If anything, it
seems like having that behavior for a SRV record would be a bug.

I'm pretty sure it's supposed to match the cert to the id.

https://wiki.xmpp.org/web/Securing_XMPP
https://prosody.im/doc/certificates (Which domain? - note the
VirtualHosts in prosody are for the domains your ids are in)

The SRV record could be viewed similarly to a CNAME record for a
website, where they server may use name-based virtual hosting (with SNI)
- the website cert needs to match what the browser asks for in the GET
request, and it could have found the ip address from a CNAME chain, or a
hosts file entry or anything.

I realise now the title, at least, is decidedly misleading. It should
probably say "... checks the certificate against the wrong domain ..."

Richard