If extended hostname validation is enabled, the following applies:
When an external XMPP server (e.g. Openfire) is federated with Presence Services, with an external domain <DOMAIN> (e.g. openfire.com) as configured in the Presence Services XMPP group attributes, then in order to establish an outgoing connection, that server’s identity certificate must match one of the following criteria:
SAN (DNSname) = <DOMAIN>
SAN (otherType=SRV) = _xmpp-server.<DOMAIN> (e.g. _xmpp-server.openfire.com)
SAN (otherType=xmppAddr) = <DOMAIN>
CN = <DOMAIN> (if-and-only-if there are no SAN present)
Note:
If both XMPP Server to Server Mutual Authentication and Extended Hostname Validation attributes are enabled, then the hostname validation will also be performed for incoming XMPP S2S connections, as Presence Services will request the far-end send its identity certificate during the negotiation process.
