# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1375728458 -7200
# Node ID 3a30ad76a86a2468ae9e55811bf90c8b4307b609
# Parent  e6a9085f0ac37a4fe10ad19a6f2d6fe78ec07178
mod_s2s: Improve policy check

diff -r e6a9085f0ac3 -r 3a30ad76a86a plugins/mod_s2s/mod_s2s.lua
--- a/plugins/mod_s2s/mod_s2s.lua	Sun Aug 04 17:33:00 2013 +0200
+++ b/plugins/mod_s2s/mod_s2s.lua	Mon Aug 05 20:47:38 2013 +0200
@@ -642,7 +642,7 @@
 		must_secure = false;
 	end
 	
-	if must_secure and not session.cert_identity_status then
+	if must_secure and (session.cert_chain_status ~= "valid" or session.cert_identity_status ~= "valid") then
 		module:log("warn", "Forbidding insecure connection to/from %s", host);
 		if session.direction == "incoming" then
 			session:close({ condition = "not-authorized", text = "Your server's certificate is invalid, expired, or not trusted by "..session.to_host });