http://www.igniterealtime.org/issues/browse/OF-44

The short story is that Openfire 3.6.4 isn’t RFC compliant on resolving DNS records. This causes problems with XMPP domains that provide multiple SRV records. Google is one of them.

S2S connections worked with Google Talk for the longest time (since I started hosting Jabber in 2005)! I wonder when Google made the change? Oh well. It looks like I get to wait for the next release of Openfire. Which according to http://www.igniterealtime.org/community/message/202626 should be soon.

Go Openfire developers! I’ll be impatiently waiting.

Your server must be running JRE 6 with the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 6 to be able to use a certificate generated by StartCom.

My experience is Debian based, so these instructions will be written as such. All terminal commands below are performed as root.

Step 0 – Delete Existing Certificates

Log in to your Openfire server at http://yourserver:9090

Under “Server Settings” select “Server Certificates”

Delete all listed certificates.

Step 1 – Install and configure JRE 6

To install Java 6 JRE, simply do:

apt-get install sun-java6-jre

Next, we want to make sure JRE 6 is the default for java on our server.

update-alternatives --config java

Be sure to select the option corresponding to /usr/lib/jvm/java-6-sun/jre/bin/java (option 3 on my server).

Step 2 – Install JCE Unlimited Strength Jurisdiction Policy Files 6

Download the files from http://java.sun.com/javase/downloads/index.jsp

Copy the files US_export_policy.jar and local_policy.jar to /usr/lib/jvm/java-6-sun/jre/lib/security overwriting what already exist. Be sure to retain the permissions the old files had.

Openfire will continue to use the old JRE until its environment variables are updated. I was too lazy to do this, so I rebooted my server. This worked for me!

Step 3 – Obtain Private Key & Certificate From StartCom

Go to https://www.startssl.com/ and go through the process of creating an account (if you haven’t already). Then request a Jabber/XMPP certificate through them for your server. Don’t use an Openfire generated CSR, let StartCom generate the private key for you.

Save the private key and its password!! If you lose this, your certificate will be invalid and you will NOT be able to re-request the certificate from StartCom! We will be using it in a later step.

Note: Since StartCom is generating the private key, you may have to wait a few hours for your request to be confirmed.

Step 4 – Install StartCom’s Class 1 Intermediate and Root Certificates

Note: You can perform this step while you’re waiting for your certificate to be generated.

Download StartCom’s class1 intermediate certificate here: https://www.startssl.com/certs/sub.class1.server.ca.pem and StartCom’s root certificate here: https://www.startssl.com/certs/ca.pem.

Copy the root and intermediate certificates to a logical location in your server. I worked in ~/ssl/ to keep things organized.

To install the certificates, use the following commands (each command is 1 line):

keytool -import -trustcacerts -alias startcom.ca -file ca.pem -keystore /usr/share/openfire/resources/security/truststore

keytool -import -trustcacerts -alias startcom.ca.sub -file sub.class1.server.ca.pem -keystore /usr/share/openfire/resources/security/truststore

You will be prompted for a password. The default password is “changeit”.

(It is recommended that you change the keystore and truststore passwords. For instructions on how to do this, see http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/ssl-guide.html)

Step 5 – Additional Openfire Configuring

Browse to your Openfire server at http://yourserver:9090

Under “Server Manager”, select “System Properties”

Add/edit the following properties with the following values:

Property Name – Property Value
xmpp.socket.ssl.active – true
xmpp.socket.ssl.port – 5223
xmpp.socket.ssl.storeType – JKS
xmpp.socket.ssl.keystore – resources/security/keystore
xmpp.socket.ssl.keypass – changeit
xmpp.socket.ssl.truststore – resources/security/truststore
xmpp.socket.ssl.trustpass – changeit

(It’s recommended that you change the keystore and truststore passwords. See http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/ssl-guide.htmlfor instructions on how to do this.)

Step 6 – Installing Private Key & Certificate

Now we’re ready to install the certificate! Log back into your Openfire server at http://yourserver:9090.

Under “Server Settings” select “Server Certificates”. You should be prompted with the message

“One or more certificates are missing. Click here to generate self-signed certificates or here to import a signed certificate and its private key.”

Click the second link corresponding to importing a signed certificate.

In the first field, type your private key’s password. Copy the private key generated by StartCom and paste it in the second field. Copy the XMPP certificate generated by StartCom and paste it in the 3rd field.

Click save. You should now be back at the “Server Certificates” page with your certificate listed below. You will still be prompted with the “One or more certificates are missing.” error, but simply ignore it. This is because Openfire is looking for an RSA and a DSA certificate. You don’t need both.

Restart Openfire and…success!

In any case, deleting it (and the entire /opt/mono directory…I don’t need it) seemed to fix the problem. MySQL is working (or else you wouldn’t be reading this). :shrug:

I had been stringing the loan along since I purchased the extended warranty back in ‘06. But, now that the warranty has expired, it’d extremely suck to have a car payment AND repair bills (although, this car has been pretty solid). It was sort-of on a whim (one of those “turn your head the other way and click” sort of things), but I had the money sitting in my savings account. Granted, it was being saved for when we buy a house…but that’s on hold for the moment. I’ll make a good chunk of it back by the time we’re ready to continue the home hunting trek via saving my car payment plus other extra cash. So, in my eyes, it’s a win win! Improves my credit report (less debt), and I’m throwing away less money (not paying interest).

So…meh.

So now, Apache forces (or should force) https upon anybody who tries to log in or view content under /wp-admin.

I should buy a certificate and server all of HHSn over HTTPS! …just kidding.

That is all!

A news crew came to my school yesterday and did a little segment about Mr. Yob’s (one of our teachers) class learning about the inauguration and what this election means to our country. They showed blips of the ever so stressful (but pretty neat/fun) school-wide Skype conference I managed (and the principal hosted) with one of our teachers who happened to fly out to go to the inauguration in person.

Check it out!

Friday night we arrived in Beverly Hills/Los Angeles area around 1 AM. We checked in to our hotel, which felt really creepy that late at night. There was no parking as a couple jackasses took up two spaces with their cars, so I was forced to park on a side street. I was nervous at first, but it was actually no big deal. Come light, the place and neighborhood was actually okay.

We stayed in the Beverly Inn, which is by no means a fancy hotel, but it wasn’t all that bad. We were across the street from the CBS studios, which was kinda cool. Saturday morning we took a walk and decided to eat at a place called Tart. Their portions were perfect, and their prices weren’t bad for the area as well. Afterwards, Brianna and I parted and did our own thing. What brought us to L.A. was an X-Files afiliated charity event Brianna wanted to attend. So, she did her thing and I did mine…

My first stop was my cousin Debbie’s house in Bellflower. I am very thankful for my TSX’s naviation system because with its aide I never made any major wrong moves. I felt like I dominated in L.A. traffic! Anywho…it was only supposed to take me a half hour to get from where I was in L.A. to Bellflower, but I had a little trouble at the gas station. It turns out that I pulled into a “full service” lane at the gas staiton! Without noticing, I start the process of getting gas and the attendant comes out and was like “hey, you’re in the full service lane!” I was like, “wha?!”. So, I apologized, canceled the transaction, and moved to a “self serve” pump. Here’s where the problem started. Apparently, Chevron (or at least this station) has a policy to where you must wait a certain period of time before a card with a canceled transaction can start another. After attempts at two pumps, I finally go see the attendant and he told me this. So, he rung me up for $20 worth of gas, I filled up, and I was on my way.

To get from where I was in L.A. to Bellflower, I had to take 101 to 710 to 105. It was a lot of fun. There were two things I had to get used to. 1) Carpool seems to be 24 hours, 2) Metering lights are more often on than not. Once I remembered those (and brought some patience), I was set. So Debbie and I hung out for a while, talked and whatnot. It was nice to see her. I’ll definitely do it again.

After my visit with Debbie, I went and saw my friend Sam down in Irvine. took me about a half hour to get down there which was expected. To get there, I had to take 91 to 605 to 405 to 73. Apparently, a portion of 73 is accompanied by toll, but luckily my exit was just before toll started. I got there with little problem as well. My only mistake was I turned into a UC parking lot rather than the shopping center where we were to meet. The shopping center and the UC lot I was in were maybe 500 feet apart, so it wasn’t a big deal.

I met Sam at Lee’s Sandwhiches in the university shopping center. Afterwards, he showed me around U.C. Irvine. The library has a pretty cool shelving system for material they deem less popular. The shelves are normal library shelves, but they’re on a track and slide around like an accordian. You can only access one side of a given shelf at a time. So, it saves a lot of space. The neatest part about it is that it’s computer controlled. There’s a simple control panel on the side of each shelving unit, and you can tell the system which side of which shelf you want to access, and it takes care of the rest! Sam also showed me the building he does most of his work in. He’s got a nice 30 inch Apple Cinema Display at his disposal, and a fancy lab coat with “Dr. Kaufman” embroidered on it. There were lots of neat projects spread around the building, something you just have to see for yourself. I thought it was all very neat.

After we finished with the U.C. Irvine “tour” we headed back to his apartment and “hung out”. This “hanging outage” eventually turned into something geeky. Sam decided to play One by U2 on his guitar and he wanted me to sing. Me, having zero singing voice, obviously didn’t want to sing. I jokingly suggested that the computer can sing for me, and it lead to this…

U2botic – One

It’s just a short 10 second clip that we whipped up in like 10-15 minutes. We didn’t have time to fine tune it as I was due back to Beverly Hills by the time the idea exploded. It was a lot of fun hanging out with Sam. Hopefully we’ll do it again!

Sunday, Brianna and I decided to check out the Santa Monica Pier. It wasn’t as exciting as we thought it would be, but it was neat nevertheless. If the weather was better (it was overcast when we were there) I’m sure the experience would’ve been better, too. We stopped at a local Denny’s to get a bite to eat and then we hit the road. Highways 10 to 405 to 5 to 152 to 101 to 85 to 17, all over the course of 340 miles.

All in all, it was fun!

Car Maintenance
I spent most of my Saturday sitting at Los Gatos Acura waiting for my car to be serviced. All I needed was a routine oil change along with a 4 wheel alignment (since I bought new tires). What was supposed to be a simple $140 combined job turned into $450. The technician working on my car discovered that a suspension component related to my right rear wheel was bent which would prevent them from being able to give the car a proper alignment. So, I opted for them to replace the component. The part itself wasn’t expensive (only being $75) it was the labor and second alignment that brought up the cost of the repair. I’ve had a relatively good experience with Los Gatos Acura, so since I was there I figured why not.

Rooster T Feathers
Brianna’s parents bought tickets for the four of us to go to a comedy show Saturday night at Rooster T Feathers in Sunnyvale. It was a lot of fun! The night’s acts were Mike Gardner, Robert Mac, and Brent Weinbach. Our table was right up against the stage, so naturally we were the inspiration for some of the comedians’ jokes. Mike Gardner happened to notice Brianna’s dad was wearing a fanny pack and did a bit about that. It was pretty funny. At one point while he was doing his thing, he stopped, looked at Brianna’s dad, and said “Are you with me Fanny Pack?!” I don’t know why, but that hit the funny spot and had me laughing for a few minutes. It was fun.