The official ejabbered documentation instructs the user to generate a self-signed certificate like this:

openssl req -new -x509 -newkey rsa:1024 -days 3650 -keyout privkey.pem -out server.pem
openssl rsa -in privkey.pem -out privkey.pem
cat privkey.pem >> server.pem
rm privkey.pem

That is based on the jabbered 2 documentation.

The first thing that caught my attention was the small key size. However, what concerns me more is that they are combining the public and private keys. Isn't the certificate (which in this case contains the public and private keys!) presented to the client upon connection, or does Jabber work differently somehow? How can I impliment TLS on ejabbered securely?


On the connection, the server will send only the certificate (the public part). However, the server needs both the public and the private key to work. The server code expects to find both object in the same file (in the file, both are encoded in Base64 with explicit PEM headers like "BEGIN CERTIFICATE" and "BEGIN PRIVATE KEY", so the server code has no trouble finding out the certificate and the private key).

If unsure, run some network monitor software like Wireshark to see what is actually sent on the wire (observing in details a TLS handshake is a very good pedagogical experience which is highly recommended anyway).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.