---
labels:
- 'Stage-Alpha'
- 'Type-Auth'
summary: Client Certificate authentication module
...
Introduction
============
This module implements PKI-style client certificate authentication. You
will therefore need your own Certificate Authority. How to set that up
is beyond the current scope of this document.
Configuration
=============
authentication = "ccert"
certificate_match = "xmppaddr" -- or "email"
c2s_ssl = {
cafile = "/path/to/your/ca.pem";
capath = false; -- Disable capath inherited from built-in default
verify = {"peer"; "client_once"}; -- Ask for client certificate
verifyext = {
-- Don't validate client certs as if they were server certs
lsec_ignore_purpose = false
}
}
Compatibility
=============
----------------- --------------
trunk Works
0.10 and later Works
0.9 and earlier Doesn't work
----------------- --------------