iChat Server with SSL

Question

Level 1

47 points

iChat Server with SSL

On the company network, iChat Server with SSL works like a dream.

Off the company network, iChat Server with SSL goes into a "an SSL error has occurred and a secure connection to the server cannot be made" loop.

The SSL that we use is signed by the CA created on the OS X Server. The CA is also trusted on the client machine.

On the log, it seems it would never go beyond the following:
Apr 19 19:01:19 domain jabberd/c2s[153]: [12] [outsid-ip, port=48586] connect
Apr 19 19:01:19 domain jabberd/c2s[153]: [12] [outsid-ip, port=48586] disconnect

Anyone has any clue? Thanks.

MacBook, Mac OS X (10.5.6)

Posted on Apr 19, 2009 4:02 AM

Reply

Answer 1

John Chen Author

Level 1

47 points

Apr 19, 2009 4:07 AM in response to John Chen

I just checked logging on my company's iChat Server using Adium.

It logged on without any hitch. Now I'm really confused. If Adium can do it and beejive on my iPhone can do it, why can't iChat do it?

Reply

Answer 2

John Chen Author

Level 1

47 points

Apr 19, 2009 4:14 AM in response to John Chen

Strangely enough, I just changed the password setting to not using Kerberos. The problem goes away.

On network, Kerberos works.
Off network, Kerberos doesn't.

Reply

Answer 3

davidh

Level 4

1,896 points

Apr 19, 2009 7:56 PM in response to John Chen

In both cases the issue is quite probably due to DNS.

What is your server's FQDN and has your network administrator arranged for externally available DNS servers to answer for that same FQDN with results that point back to your external ("WAN") IP(s) ?
Along with appropriate port-forwarding and firewall rules as well.

Please post the unedited result of (typed into the Terminal and executed by pressing Enter/Return):

sudo changeip -checkhostname

Reply

Answer 4

John Chen Author

Level 1

47 points

Apr 19, 2009 8:52 PM in response to davidh

This is what I get...

begin
Primary address = 192.168.1.47

Current HostName = XXX.net
DNS HostName = XXX.net

The names match. There is nothing to change.
end

On the outside, the external IP is pointed to the right FQDN.

Reply