клиентские ключи ssl для сервера jabberd2

<!-- File containing an SSL certificate and private key to use when
         setting up an encrypted channel with the router. From
         SSL_CTX_use_certificate_chain_file(3): "The certificates must be
         in PEM format and must be sorted starting with the subject's
         certificate (actual client or server certificate), followed
         by intermediate CA certificates if applicable, and ending
         at the highest level (root) CA" (the latter one being optional).
         If this is commented out, or the file can't be read, no attempt
         will be made to establish an encrypted channel with the router. -->

<pemfile>/usr/etc/server.pem</pemfile>

openssl req -new -x509 -newkey rsa:1024 -days 3650 -keyout privkey.pem -out server.pem
openssl rsa -in privkey.pem -out privkey.pem
cat privkey.pem >> server.pem
rm privkey.pem
mv server.pem /usr/etc/server.pem
chown root:jabber /usr/etc/server.pem    
chmod 640 /usr/etc/server.pem

<!--
cachain
         SSL CA chain. Used to verify client certificates.
         CA names published to client upon connection.
-->

    <id realm='domen.org'
        pemfile='/usr/etc/server.pem'
        verify-mode='7'
        cachain='/usr/etc/client_ca_certs.pem'
        require-starttls='mu'
        register-oob='http://example.net/register'
        password-change='mu'
    >domen.org</id>

<!--
register-oob
         URL to be attached as an alternative, out-of-band registration
         method. Usually web-based http:// URL.
-->

C2S : Thu Nov 30 13:52:13 2017 c2s.c:42 want write
C2S : Thu Nov 30 13:52:13 2017 c2s.c:529 write action on fd 9
C2S : sx (io.c:357) 9 ready for writing
C2S : sx (io.c:312) encoding 0 bytes for writing:
C2S : sx (chain.c:79) calling io write chain
C2S : sx (ssl.c:477) in _sx_ssl_wio
C2S : sx (ssl.c:406) secure channel not established, handshake in progress
C2S : sx (ssl.c:561) prepared 1443 ssl bytes for write
C2S : sx (io.c:378) handing app 1443 bytes to write
C2S : sx (io.c:379) tag 9 event 3 data 0x88ce1e0
C2S : Thu Nov 30 13:52:13 2017 c2s.c:113 writing to 9
C2S : Thu Nov 30 13:52:13 2017 c2s.c:117 1443 bytes written
C2S : sx (io.c:412) tag 9 event 0 data 0x0
C2S : Thu Nov 30 13:52:13 2017 c2s.c:37 want read
C2S : Thu Nov 30 13:52:13 2017 c2s.c:515 read action on fd 9
C2S : sx (io.c:206) 9 ready for reading
C2S : sx (io.c:212) tag 9 event 2 data 0x88ce1e0
C2S : Thu Nov 30 13:52:13 2017 c2s.c:47 reading from 9
C2S : Thu Nov 30 13:52:13 2017 c2s.c:106 read 205 bytes
C2S : sx (io.c:231) passed 205 read bytes
C2S : sx (chain.c:93) calling io read chain
C2S : sx (ssl.c:581) in _sx_ssl_rio
C2S : sx (ssl.c:585) loading 205 bytes into ssl read buffer
C2S : sx (ssl.c:406) secure channel not established, handshake in progress
C2S : sx (ssl.c:445) openssl error: error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate
C2S : sx (io.c:522) 9 state change from 0 to 6
C2S : sx (io.c:523) tag 9 event 7 data 0x0
C2S : Thu Nov 30 13:52:13 2017 c2s.c:534 close action on fd 9

C2S : sx (ssl.c:445) openssl error: error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate

         verify-mode
         SSL verify mode - see SSL_CTX_set_verify(3), mode parameter.
         Sum of the following options:
         SSL_VERIFY_NONE                 0x00
                 SSL_VERIFY_PEER                 0x01
                 SSL_VERIFY_FAIL_IF_NO_PEER_CERT 0x02
                 SSL_VERIFY_CLIENT_ONCE          0x04
                 Use 7 to require all clients to present _valid_ certificates.