secure only

I've been thinking of the same thing ... so let me just make sure that I have this correct.

If starttls and require_starttls is setup correctly, all communications (between servers and between client and server) is encrypted. Is that correct?

I use Psi on windows and iChat on makes for a intranet only install of ejabberd. I know that I have encryption set in Psi. I don't have access to the machine right now but it is a CentOS machine. Once I get access to the box, I will post what versions I have for everything.

Compiling Erlang/OTP is the hardest part (it has several dependencies), and takes 1 hour to compile). If your distribution had some compatible Erlang packages, that would save you 95% of the work.

Compiling ejabberd is later rather easy (it only requires erlang and a few more dependencies), and takes 1 minute to compile.

I've installed ejabberd 2.1.5 Linux 32bit installer (ejabberd-2.1.5-linux-x86-installer.bin) in my machine, all default configuration and files. Then I login with the typical TLS encryption + SASL auth.

ejabberd.log:

=INFO REPORT==== 2010-09-24 17:01:04 ===
I(<0.394.0>:ejabberd_listener:232) : (#Port<0.470>) Accepted connection {{127,0,0,1},35424} -> {{127,0,0,1},5222}

=INFO REPORT==== 2010-09-24 17:01:05 ===
I(<0.406.0>:ejabberd_c2s:716) : ({socket_state,tls,{tlssock,#Port<0.470>,#Port<0.475>},<0.405.0>})
 Accepted authentication for badlop by ejabberd_auth_internal

=INFO REPORT==== 2010-09-24 17:01:05 ===
I(<0.406.0>:ejabberd_c2s:839) : ({socket_state,tls,{tlssock,#Port<0.470>,#Port<0.475>},<0.405.0>})
 Opened session for badlop@localhost/tkabber

System and library info:

$ uname -a
Linux dolmin 2.6.32-1-686 #1 SMP Mon Feb 1 01:37:26 UTC 2010 i686 GNU/Linux

$ openssl version
OpenSSL 0.9.8o 01 Jun 2010

$ aptitude show libssl0.9.8
...
Version: 0.9.8o-2

$ cat /etc/apt/sources.list | grep "^deb"
deb http://ftp.fr.debian.org/debian sid main contrib non-free

Another idea is to try to load the library manually, using the same calls that ejabberd does, and trying different ways. I start ejabberd interactively, and then I make some calls:

$ ejabberdctl live
...

(ejabberd@localhost)1> Path = os:getenv("EJABBERD_SO_PATH").
"//lib/ejabberd/priv/lib"

(ejabberd@localhost)2> erl_ddll:load_driver(Path, tls_drv).
ok

(ejabberd@localhost)3> erl_ddll:load_driver(Path, tls_drv).
ok

(ejabberd@localhost)4> erl_ddll:load_driver("/tmp/123", tls_drv).
{error,bad_driver_name}

(ejabberd@localhost)5> erl_ddll:load_driver("/lib/ejabberd/priv/lib", tls_drv).
{error,bad_driver_name}

(ejabberd@localhost)6> erl_ddll:load_driver("//lib/ejabberd/priv/lib", tls_drv).
ok

(ejabberd@localhost)9> erl_ddll:load_driver("////lib/ejabberd/priv/lib", tls_drv).
{error,bad_driver_name}

(ejabberd@localhost)11> erl_ddll:load_driver("//lib/ejabberd/priv/", tls_drv).
{error,bad_driver_name}

(ejabberd@localhost)13> erl_ddll:load_driver("//lib/ejabberd/priv/lib", expat_erl).
ok

(ejabberd@localhost)14> erl_ddll:load_driver("//lib/ejabberd/priv/lib", xml).
{error,no_driver_init}

(ejabberd@localhost)15> erl_ddll:load_driver("//lib/ejabberd/priv/lib", tls_drvaaaa).
{error,{open_error,-10}}

Let's hope this allows you to perform more fine-grained testing and detect what exactly is the problem.