Core Apps » ChatSecure:Android

Hi,

It seems that ChatSecure is trying to validate the server certificate against the account domain instead of the server. I have for example a custom domain (example.org) and use Google Apps for domains. As such, ChatSecure needs to connect to (e.g.) talk.google.com, which is the one used in the account. Google's servers serve a certificate that's for google.com, yet that doesn't match the custom domain and ChatSecure complains and awaits the user to confirm the certificate.

The problem is solved if I accept the certificate once (which TBH I'd prefer not to have to do as that's error prone and I have no great way of verifying the certificate). However, specifically for Google, it seems that their servers use a variety of certificates, all of which are valid. I.e. when I connect from the home network I get a certificate with fingerprint Fa while when I connect from the cellular network I get a certificate with fingerprint Fb. Both fully valid to the extend that I can check. This results in ChatSecure asking the same question again and aain.

On top of that, when I enter talk.google.com as the server, this gets auto-magically altered to talk.l.google.com (talk.google.com is a CNAME to talk.l.google.com in my case).

A fix for this would be to verify the server name against the certificate, either exclusively or in addition to the domain of the account. I.e. for the account test@example.org, connecting to server talk.google.com, to verify the certificate against example.org and/or talk.google.com. On top of that, ChatSecure must stop automagically changing the server name to its CNAME (is that on purpose?), because Google's chat servers that server *.google.com certs will fail to verify talk.l.google.com as the * in wildcard certificates doesn't cross domains.

Thanks for ChatSecure btw!