In case anyone is wondering about how to "update" a valid certificate from #letsencrypt that for some reason #prosody states is already expired, just run:

prosodyctl --root cert import /etc/letsencrypt/live

Assuming you have a valid certificate in place already configured for your domain. Saved me some headache!

More info: https://prosody.im/doc/letsencrypt

#xmpp #selfhost

Let's Encrypt will issue new intermediate certs in Q1/2024: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/L7XoAXt_s1c

Make sure your LE cert deployment logic includes serving the right intermediates that ACME should hand you, not just that same old LE intermediate you got years ago. Otherwise, there'll be breakage...

#x509 #pki #LetsEncrypt

Detailed and credible looking report of #LawfulInterception #MitM on an #xmpp server hosted at #Hetzner in Germany: https://notes.valdikss.org.ru/jabber.ru-mitm/

Looks like a transparent bridge was deployed in front of the actual server, obtained dedicated certificates from #LetsEncrypt and MitMed all incoming client connections since July. It was discovered because the LE certificate expired 🤦