Use this procedure to modify the Openfire server settings for TLS connections. The procedures are different depending on the version of Openfire installed. For more details, refer to Openfire documentation.
For Openfire 3.x:
On the Openfire server, navigate to Server Server Settings Security Settings.
In Server Connection Security, configure the Openfire server to use TLS:
ADDITIONAL INFORMATION:
Select Required - Connections between servers always use secured connections.
Select the Accept self-signed certificates. Server dialback over TLS is now available check box.
Click Save Settings.
For Openfire 4.x:
Navigate to Server Server Settings Server to Server Settings.
In the Plain-text (with STARTTLS) connections section, click Advanced Configuration.
In TCP Settings, select Enabled and enter Port 5269.
In STARTTLS policy, select Required.
In Mutual Authentication, select Needed if the Presence Services certificate contains a subject alternative name (SAN) of the OtherName type with an XMPPaddr identifier. Otherwise, select Disabled.
In Certificate chain checking, select Allow peer certificates to be self-signed and Verify that the certificate is currently valid.
In Encryption Protocols, clear TLSv1.1 (not supported by Avaya Aura®). Ensure that the minimum supported TLS version configured on System Manager matches the TLS versions chosen on Openfire. For example, if the minimum supported version on System Manager is TLSv1.2, then TLSv1.2 must be selected on Openfire as well.
