Getting SSL certificate chain from jabber server

Solution 1:

The solution is: Jabber requires starttls:

openssl s_client -connect my.jabber.server.net:5222 </dev/null -starttls xmpp

returns the certificate

Solution 2:

As noted in a previous answer, Jabber/XMPP requires -starttls.

Client-to-server (c2s) certificate for my.jabber.server.net.

openssl s_client -connect my.jabber.server.net:5222 </dev/null -starttls xmpp

To expand upon that answer, there are two types of connections:

• Normal client logins: -starttls xmpp, default port 5222
• Connection between servers: -starttls xmpp-server, default port 5269

Server-to-server (s2s) certificate for my.jabber.server.net.

openssl s_client -connect my.jabber.server.net:5269 </dev/null -starttls xmpp-server

With openssl v1.1.0+ you can also check custom domains, with the -xmpphost <domain> flag, or use the option alias -name in openssl v1.1.1+.

Client-to-server (c2s) certificate for custom domain other.example.org hosted by my.jabber.server.net:

openssl s_client -connect my.jabber.server.net:5222 </dev/null -starttls xmpp -xmpphost other.example.org

Server-to-server (s2s) certificate for custom domain other.example.org hosted by my.jabber.server.net:

openssl s_client -connect my.jabber.server.net:5269 </dev/null -starttls xmpp-server -xmpphost other.example.org