We’ve been integrating Unreal’s XMPP systems into our project. While things work when certificate validation is disabled, enabling cert validation causes failures. This is a blocker, as cert validation will be required for our production launch.
We’ve confirmed that our XMPP server presents a valid certificate when tested with other XMPP clients, such as Profanity.
A [previous UDN [Content removed] by another engineer on our team describes the initial issue during our first pass at XMPP integration.
Since then, I’ve been digging into this issue further. When enabling TLS cert validation, we see the following errors in the logs:
VeryVerbose LogXmpp libstrophe[38660] xmpp debug: proceeding with TLS
VeryVerbose LogXmpp libstrophe[38660] tls debug: Certificate verification FAILED
VeryVerbose LogXmpp libstrophe[38660] tls debug: Certificate was not presented by peer
VeryVerbose LogXmpp libstrophe[38660] tls debug: error=1 errno=2
Unreal’s XMPP system uses the third party libstrophe under the hood. Specifically, a forked/modified version of libstrophe 0.9.3.
To investigate further, I began modifying the 0.9.3 libstrophe code and recompiling the lib files. Eventually I confirmed the core issue with a code change in the tls_openssl.c file to explicitly load certs from the Windows cert store (see attached tls_openssl_modification.c file).
This confirmed that the version of OpenSSL that libstrophe uses doesn’t automatically have access to the Windows cert store and whatever built-in/default it’s using won’t work with our XMPP cert. With the code change I made, we load the certs from the Windows cert store. I confirmed that with this change XMPP/libstrophe are working properly with cert validation enabled.
Ideally, though, we’d prefer to explicitly configure libstrophe to use the CA file already packaged with the game. This would make the solution portable across all our supported platforms.
I initially hoped upgrading Unreal’s libstrophe version to the official 0.11.0 libstrophe (which supports xmpp_conn_set_cafile) would be straightforward. However, we discovered that Unreal’s fork of 0.9.3 includes significant customizations (including WebSocket support) that aren’t present in the official libstrophe code.
Given that, it seems like our most straightforward path is to port the certificate authority code from libstrophe 0.11.0 into Unreal’s 0.9.3 libstrophe fork.
Before proceeding, I wanted to confirm that my understanding of the issue is accurate. Are there any alternative solutions I might be overlooking?