ejabberd - Comments for "ejabberd_http on two ports?"

Re: Yeah, that was an oops.

sander — Wed, 02 Aug 2006 22:53:08 +0000

heisters wrote:

Yeah, that was an oops. Unfortunately, changing it doesn't fix anything... neither does switching from tls to starttls, which I would think would only provide encryption if the client supported it.

The example in the official documentation works for me. Are you sure it is no JWChat config issue?

Re: ejabberd_http on two ports?

heisters — Tue, 18 Jul 2006 15:34:08 +0000

badlop wrote:

If you want encryption for JWChat, instead of adding encryption to HTTP-Poll, add it to your HTTP server. After all, your users connect to your Jabber server using HTTP, not HTTP-Poll, right?

I've already got SSL for the JWChat web interface. But the web interface passes usernames and passwords to the HTTP-POLL interface, so it's not so secure if JWChat can't connect to an SSL HTTP-POLL.

Re: ejabberd_http on two ports?

mfoss — Tue, 18 Jul 2006 11:13:19 +0000

heisters wrote:

2) get ejabberd_http to listen on two ports, one with SSL enabled, and the other without.

You forgot option 3), and it works:

  {5280, ejabberd_http,    [http_poll]},
  {5284, ejabberd_http,    [web_admin, tls, {certfile, "/etc/ssl/certs/ejabberd.pem"}]}

If you want encryption for JWChat, instead of adding encryption to HTTP-Poll, add it to your HTTP server. After all, your users connect to your Jabber server using HTTP, not HTTP-Poll, right?

Yeah, that was an oops.

heisters — Mon, 17 Jul 2006 18:34:46 +0000

Yeah, that was an oops. Unfortunately, changing it doesn't fix anything... neither does switching from tls to starttls, which I would think would only provide encryption if the client supported it.

Re: ejabberd_http on two ports?

legoscia — Thu, 13 Jul 2006 22:43:25 +0000

heisters wrote:

{5280, ejabberd_http, [http_poll, web_admin]},
{5284, ejabberd_http, [http_poll, web_admin, tls, {certfile, "/etc/ssl/certs/ejabberd.pem"}, starttls_required]}

This looks correct, except that starttls_required shouldn't be there (the connection is TLS from the beginning, so there is no need to "start" TLS). Not sure if that is the problem, though...