Do *NOT* remove TLS Client Auth EKU!

[rolandturner]

@mirabilos

Given the small size of the XMPP ecosystem, it is likely that a handful
of adminstrators doing this diligently

Administrators cannot do much here, given very prominent XMPP servers
are written in… very opinionated and rare languages (Erlang especially,
but others as well), this is something for the developers of the
respectice server softwares.

the entire XMPP ecosystem weaned off TLS client certificates for S2S

Unlikely, as older servers are also still around.

I'm not suggesting modifying any software. Bear in mind that XMPP has been around far longer than LE has, and has long-established s2s mechanisms that don't rely upon TLS client authentication at all.

You've not pointed to empirical data[1], but even if a significant number of museum exhibits are still in production use on the public Internet[2], this is probably an opportune time for those sites to upgrade at least to versions released in the current decade. xmpp.org evaluates XML Core compliance as Advanced for 6 of the 7 servers that they list. There are plenty of options.

@mirabilos

prior to suitable TLS certificates becoming unavailable

Extremely implausible; alone the release cycle of most distributions
encompasses two or more years, and this just missed e.g. the Debian
trixie freeze, so late 2027, at the earliest, will have a chance to
get this onto servers actually ran in real life.

It seems wildly improbable that currently-supported versions of Debian and other distributions have 20-year-old versions of XMPP servers in them.

---

1: but please share it if you have it!
2: And how good is their TLS implementation even if they are?