Today I finally got my xmpp.net cert working with ejabberd. I'm using latest ejabberd because since revision 841 ejabberd sends the whole certificate chain to the clients.

• ssl.key (your private key you got through the ICA certification process)
• ssl.crt (your certificate)
• the password you used during the ICA certification process
• sub.class1.xmpp.ca.crt (xmpp.net's ICA cert)

1. Create a backup of the files listed above if you haven't done it yet.
2. Decrypt ssl.key file using the following command (You will be asked for the password!): openssl rsa -in ssl.key -out ssl.key Here the difference between an encrypted ssl.key and decrypted ssl.key:

   Encrypted	Decrypted
   -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: AES-256-CBC,08625FF5291958... LH4pfqaXMm86kaFBXFNsZY8HXkPjmBvBH18V... ... dWiJwyTFzAEHXZh1bLZr1C5560FBlGySh35h... -----END RSA PRIVATE KEY-----	-----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEA8wY1jnx5koNqhPKN8UkL... ... NuFEKicDmogtN6ojyIx6+JxxKPE7Cu1ru10G... -----END RSA PRIVATE KEY-----

3. Now you put them all together. Your cert, your private key and xmpp.net's ICA cert. Use the following command: cat ssl.crt sub.class1.xmpp.ca.crt ssl.key >> myxmpp.net.crt

-----BEGIN CERTIFICATE-----
MIIH2zCCBsOgAwIBAgICAZUwDQYJKoZIhvcNAQEFBQAwgdgxCzAJBgNVBAYTAlVT
...
j1c/86uMpzRNEm6ibxe7eLNulLJbvb9UAo8jPVRSMOavngjAyvcz6sZUtCDnStQ=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIHADCCBmmgAwIBAgIBFDANBgkqhkiG9w0BAQUFADCBsDELMAkGA1UEBhMCSUwx
...
lhMZMHD/ivqg8faZSQNYMg6xq7I=
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA8wY1jnx5koNqhPKN8UkLOeex3QIFXkZeaGmeeQI5ZSsWBBqW
...
NuFEKicDmogtN6ojyIx6+JxxKPE7Cu1ru10GUs1VGBZMRqYcHJdXbg==
-----END RSA PRIVATE KEY-----

• Installing the StartCom SSL certificate in ejabberd
• Certificate README