我的工作使用本地 XMPP 服务器（Wildfire，现在称为开火)。使用 Pidgin 客户端时，它总是询问我是否应该接受无效（过期）的证书。
我想让 Pidgin 始终接受它而不询问我。如何在不安装新证书的情况下在 XMPP 服务器上实现此目的？
我尝试将证书导入我的个人存储和受信任的根存储，但仍然收到相同的提示。证书也存储在 中%APPDATA%\.purple\certificates\x509\tls_peers，但我仍然收到提示。
这是连接时的调试日志：
Pidgin Debug Log : 10/4/2016 12:05:16 PM
(12:05:05) account: Connecting to account [email protected]/.
(12:05:05) connection: Connecting. gc = 04528D78
(12:05:05) dnssrv: querying SRV record for 192.168.1.21: _xmpp-client._tcp.192.168.1.21
(12:05:05) dnssrv: Couldn't look up SRV record. The filename, directory name, or volume label syntax is incorrect. (123).
(12:05:05) dnsquery: Performing DNS lookup for 192.168.1.21
(12:05:05) dnsquery: IP resolved for 192.168.1.21
(12:05:05) proxy: Attempting connection to 192.168.1.21
(12:05:05) proxy: Connecting to 192.168.1.21:5222 with no proxy
(12:05:05) proxy: Connection in progress
(12:05:05) proxy: Connecting to 192.168.1.21:5222.
(12:05:05) proxy: Connected to 192.168.1.21:5222.
(12:05:05) jabber: Sending ([email protected]): <?xml version='1.0' ?>
(12:05:05) jabber: Sending ([email protected]): <stream:stream to='192.168.1.21' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>
(12:05:05) jabber: Recv (579): <?xml version='1.0' encoding='UTF-8'?><stream:stream xmlns:stream="http://etherx.jabber.org/streams" xmlns="jabber:client" from="192.168.1.21" id="da08260e" xml:lang="en" version="1.0"><stream:features><starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"></starttls><mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl"><mechanism>PLAIN</mechanism><mechanism>CRAM-MD5</mechanism><mechanism>DIGEST-MD5</mechanism><mechanism>ANONYMOUS</mechanism></mechanisms><auth xmlns="http://jabber.org/features/iq-auth"/><register xmlns="http://jabber.org/features/iq-register"/></stream:features>
(12:05:05) jabber: Sending ([email protected]): <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
(12:05:05) jabber: Recv (50): <proceed xmlns="urn:ietf:params:xml:ns:xmpp-tls"/>
(12:05:05) nss: SSL version 3.1 using 128-bit AES with 160-bit SHA1 MAC
Server Auth: 2048-bit RSA, Key Exchange: 1024-bit DHE, Compression: NULL
Cipher Suite Name: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
(12:05:05) nss: subject=CN=Unknown,OU=Unknown,O=REDACTED,L=REDACTED,ST=REDACTED,C=US issuer=CN=Unknown,OU=Unknown,O=REDACTED,L=REDACTED,ST=REDACTED,C=US
(12:05:05) certificate/x509/tls_cached: Starting verify for 192.168.1.21
(12:05:05) certificate/x509/tls_cached: Certificate 192.168.1.21 expired at Mon Aug 29 09:54:35 2016
(12:05:05) certificate/x509/tls_cached: Checking for cached cert...
(12:05:05) certificate/x509/tls_cached: ...Found cached cert
(12:05:05) nss/x509: Loading certificate from C:\Users\example\AppData\Roaming\.purple\certificates\x509\tls_peers\192.168.1.21
(12:05:05) certificate/x509/tls_cached: Peer cert matched cached
(12:05:07) util: Writing file accounts.xml to directory C:\Users\example\AppData\Roaming\.purple
(12:05:07) util: Writing file C:\Users\example\AppData\Roaming\.purple\accounts.xml
(12:05:07) util: Writing file blist.xml to directory C:\Users\example\AppData\Roaming\.purple
(12:05:07) util: Writing file C:\Users\example\AppData\Roaming\.purple\blist.xml
(12:05:07) certificate/x509/tls_cached: User ACCEPTED cert
Caching first in chain for future use as 192.168.1.21...
(12:05:07) nss/x509: Exporting certificate to C:\Users\example\AppData\Roaming\.purple\certificates\x509\tls_peers\192.168.1.21
(12:05:07) util: Writing file C:\Users\example\AppData\Roaming\.purple\certificates\x509\tls_peers\192.168.1.21
(12:05:07) nss: Trusting CN=Unknown,OU=Unknown,O=REDACTED,L=REDACTED,ST=REDACTED,C=US
(12:05:07) certificate: Successfully verified certificate for 192.168.1.21
答案1
不幸的是不可能永久接受过期的证书（至少在目前的最新版本 Pidgin 2.11.0 中不是）。
官方有很多关于这个问题的报道Pigdin 问题追踪系统通常的答案是服务器的证书必须修复。
你也可以用 Pidgin 来确认来源：
证书验证开始于x509_tls_cached_start_verify。对于过期证书，将PURPLE_CERTIFICATE_EXPIRED设置标志。
如果在缓存中找到证书，x509_tls_cached_cert_in_cache则调用 。它会验证实际证书指纹是否与缓存中的证书指纹匹配，然后调用x509_tls_cached_complete。
此函数执行以下操作之一：
- 通知用户证书无效（如果存在某些严重的证书问题）
- 让用户决定是否接受/拒绝证书（如果存在非致命问题；证书过期就是这种情况）
- 如果证书没有问题，则继续进行，不会有任何提示
没有办法跳过有关证书过期的警告（除了修复证书本身）。
答案2
什么@ge0rdi说的没错，但你可以尝试手动下载 SSL 证书。这样做会让 pidgin 无需请求许可即可启动 :)
使用以下命令：
~/.purple/certificates/x509/tls_peers$ openssl s_client -connect YOUR_SERVER:PORTNUMBER
如果失败，请在命令中附加 -starttls xmpp，如下所示：
~/.purple/certificates/x509/tls_peers$ openssl s_client -connect YOUR_SERVER:PORTNUMBER -starttls xmpp
将文件放在以下文件夹中：
~/.purple/certificates/x509/tls_peers
笔记！确保文件名是服务器的 DNS 名称。
编辑：
猜猜谁刚刚注意到你使用的是 Windows 机器……~/ 是 Linux 用户的主分区。根据这一页Windows 上的对应目录是 %APPDATA%。