# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1743525086 -7200
# Node ID 3627980e7df6bec96b093ca06bdc038eabbe17e1
# Parent  a353db59f9424e582494dcdc3c3a18c815122ca2# Parent  7c76ca78ceef5336170ad4a9b4f070e1f111d239
Merge 13.0->trunk

diff -r a353db59f942 -r 3627980e7df6 plugins/mod_s2s.lua
--- a/plugins/mod_s2s.lua	Mon Mar 31 21:23:35 2025 +0200
+++ b/plugins/mod_s2s.lua	Tue Apr 01 18:31:26 2025 +0200
@@ -999,7 +999,7 @@
 			local cert_errors = set.new(session.cert_chain_errors[1]);
 			if cert_errors:contains("certificate has expired") then
 				return "has expired";
-			elseif cert_errors:contains("self signed certificate") then
+			elseif cert_errors:contains("self signed certificate") or cert_errors:contains("self-signed certificate") then
 				return "is self-signed";
 			elseif cert_errors:contains("no matching DANE TLSA records") then
 				return "does not match any DANE TLSA records";
diff -r a353db59f942 -r 3627980e7df6 plugins/mod_tls.lua
--- a/plugins/mod_tls.lua	Mon Mar 31 21:23:35 2025 +0200
+++ b/plugins/mod_tls.lua	Tue Apr 01 18:31:26 2025 +0200
@@ -55,6 +55,7 @@
 
 	module:log("debug", "Creating context for c2s");
 	local request_client_certs = { verify = { "peer", "client_once", }; };
+	local custom_cert_verification = { verifyext = { "lsec_continue", "lsec_ignore_purpose" }; };
 	local xmpp_alpn = { alpn = "xmpp-server" };
 
 	ssl_ctx_c2s, err_c2s, ssl_cfg_c2s = create_context(host.host, "server", host_c2s, host_ssl, global_c2s); -- for incoming client connections
@@ -67,7 +68,9 @@
 
 	module:log("debug", "Creating context for s2sin");
 	-- for incoming server connections
-	ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server", host_s2s, host_ssl, global_s2s, request_client_certs);
+	ssl_ctx_s2sin, err_s2sin, ssl_cfg_s2sin = create_context(host.host, "server",
+		host_s2s, host_ssl, global_s2s, request_client_certs, custom_cert_verification
+	);
 	if not ssl_ctx_s2sin then module:log("error", "Error creating contexts for s2sin: %s", err_s2sin); end
 
 	if reload then
diff -r a353db59f942 -r 3627980e7df6 prosodyctl
--- a/prosodyctl	Mon Mar 31 21:23:35 2025 +0200
+++ b/prosodyctl	Tue Apr 01 18:31:26 2025 +0200
@@ -195,6 +195,7 @@
 			elseif init == "rc.d" then
 				show_warning("          /etc/init.d/prosody %s", service_command);
 			end
+			show_warning("");
 		else
 			show_warning("       it may conflict with your system's service manager.");
 			show_warning("");