[plotters]

Use managed TLS certificates for external component listeners

With tls: true and no listener-specific certfile, ejabberd_service passes TLS options without a certificate to fast_tls, which rejects the connection before sending a server certificate. This prevents external components from using built-in ACME certificates without configuring internal certificate paths that can change on renewal.

Resolve the initial certificate through ejabberd_pkix:get_certfile(Server) when the listener has no explicit certificate. This uses the existing certificate manager and its default fallback. Each TLS options callback resolves the current path, allowing subsequent connections to use a replacement certificate. Explicit listener certificates retain precedence, and other TLS options are preserved. This changes certificate selection for the XEP-0114 listener without changing the component protocol.

Validation

Check	Result	Remaining work
Managed certificate selection	Passed	None
Explicit certificate precedence	Passed	None
Changed managed certificate path	Passed	None
No available certificate	Passed	None
Compilation and EUnit	Passed: four tests, zero failures	Existing unrelated deprecation warnings
TLS handshake, SNI, and ACME renewal	Not run	Verify against a running server

From the ejabberd checkout, after configuring its build environment:

sh autogen.sh
./configure
./rebar3 eunit --module=ejabberd_service_tests

For integration verification, configure ejabberd_service with tls: true and no certfile, confirm an SNI-enabled OpenSSL connection presents the managed certificate, replace the managed certificate through the normal certificate manager, and verify a fresh connection presents the replacement without restarting. Also verify an explicit listener certificate still works and SNI can select a certificate for another managed hostname.

Verified with Erlang/OTP 29 and Rebar 3.27.0.

[p1bot]

Hi @plotters, many thanks for your contribution!

In order for us to evaluate and accept your PR, we ask that you sign a contribution license agreement. It's all electronic and will take just minutes.

[badlop]

This PR fixes the issue described in #4644

[plotters]

Hi @plotters, many thanks for your contribution!

In order for us to evaluate and accept your PR, we ask that you sign a contribution license agreement. It's all electronic and will take just minutes.

I requested to sign the CLA but did not get an email to sign it yet. @badlop can you resend it? Thanks!

[badlop]

Ok, I've reported the problem, I guess it will get fixed next week. I'll comment here again when it's ready.

[p1bot]

You did it @plotters!

Thank you for signing the ProcessOne Contribution License Agreement.

We will have a look at your contribution!