OF-3135: Improve wording of TLS Auth setting

In server-to-server configuration on the admin console, there’s a checkbox that controls if any other authentication mechanism can be used, if SASL EXTERNAL was attempted, but failed.

The rationale being that if a strong mechanism fails, using a weaker mechanism can lead to exploitable security loopholes.

The current text for this option is:

> If attempting to validate a cerificate fails, the connection is closed and not attempted via dialback authentication

This is confusing. Improve it, for example by using:

> Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication)

(cherry picked from commit 994d9b7)

Author: guusdk

i18n/src/main/resources/openfire_i18n.properties

@@ -1683,7 +1683,7 @@ connection.advanced.settings.clientauth.info=In addition to requiring peers to u
 connection.advanced.settings.clientauth.label_disabled=<b>Disabled</b> - Peer certificates are not verified.
 connection.advanced.settings.clientauth.label_wanted=<b>Wanted</b> - Peer certificates are verified, but only when they are presented by the peer.
 connection.advanced.settings.clientauth.label_needed=<b>Needed</b> - A connection cannot be established if the peer does not present a valid certificate.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Certificate chain checking
 connection.advanced.settings.certchain.info=These options configure some aspects of the verification/validation of the certificates that are presented by peers while setting up encrypted connections.

i18n/src/main/resources/openfire_i18n_cs_CZ.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=In addition to requiring peers to u
 connection.advanced.settings.clientauth.label_disabled=<b>Disabled</b> - Peer certificates are not verified.
 connection.advanced.settings.clientauth.label_wanted=<b>Wanted</b> - Peer certificates are verified, but only when they are presented by the peer.
 connection.advanced.settings.clientauth.label_needed=<b>Needed</b> - A connection cannot be established if the peer does not present a valid certificate.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Certificate chain checking
 connection.advanced.settings.certchain.info=These options configure some aspects of the verification/validation of the certificates that are presented by peers while setting up encrypted connections.

i18n/src/main/resources/openfire_i18n_de.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=Zusätzlich zur Anforderung, dass C
 connection.advanced.settings.clientauth.label_disabled=<b>Deaktiviert</b> - Client-Zertifikate werden nicht verifiziert.
 connection.advanced.settings.clientauth.label_wanted=<b>Bevorzugt</b> - Client-Zertifikate werden verifiziert, aber nur, wenn sie vom Client vorgelegt werden.
 connection.advanced.settings.clientauth.label_needed=<b>Benötigt</b> - Eine Verbindung kann nicht hergestellt werden, wenn der Client kein gültiges Zertifikat vorlegt.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Überprüfung der Zertifikatskette
 connection.advanced.settings.certchain.info=Diese Optionen konfigurieren einige Aspekte der Verifizierung/Validierung der Zertifikate, die von Clients beim Aufbau verschlüsselter Verbindungen präsentiert werden.

i18n/src/main/resources/openfire_i18n_es.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=Además de requerir que los pares u
 connection.advanced.settings.clientauth.label_disabled=<b>Deshabilitado</b> - Los certificados de los pares no serán verificados.
 connection.advanced.settings.clientauth.label_wanted=<b>Esperado</b> - Los certificados de los pares se verifican pero solo cuando son presentados por el par.
 connection.advanced.settings.clientauth.label_needed=<b>Necesario</b> - No se puede establecer una conexión si el par no presentan un certificado válido.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Verificación de cadena de certificados
 connection.advanced.settings.certchain.info=Estas opciones configuran algunos aspectos de la verificación/validación de los certificados presentados por los pares al configurar conexiones cifradas.

i18n/src/main/resources/openfire_i18n_he.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=In addition to requiring peers to u
 connection.advanced.settings.clientauth.label_disabled=<b>Disabled</b> - Peer certificates are not verified.
 connection.advanced.settings.clientauth.label_wanted=<b>Wanted</b> - Peer certificates are verified, but only when they are presented by the peer.
 connection.advanced.settings.clientauth.label_needed=<b>Needed</b> - A connection cannot be established if the peer does not present a valid certificate.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Certificate chain checking
 connection.advanced.settings.certchain.info=These options configure some aspects of the verification/validation of the certificates that are presented by peers while setting up encrypted connections.

i18n/src/main/resources/openfire_i18n_ja_JP.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=In addition to requiring peers to u
 connection.advanced.settings.clientauth.label_disabled=<b>Disabled</b> - Peer certificates are not verified.
 connection.advanced.settings.clientauth.label_wanted=<b>Wanted</b> - Peer certificates are verified, but only when they are presented by the peer.
 connection.advanced.settings.clientauth.label_needed=<b>Needed</b> - A connection cannot be established if the peer does not present a valid certificate.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Certificate chain checking
 connection.advanced.settings.certchain.info=These options configure some aspects of the verification/validation of the certificates that are presented by peers while setting up encrypted connections.

i18n/src/main/resources/openfire_i18n_pl_PL.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=In addition to requiring peers to u
 connection.advanced.settings.clientauth.label_disabled=<b>Disabled</b> - Peer certificates are not verified.
 connection.advanced.settings.clientauth.label_wanted=<b>Wanted</b> - Peer certificates are verified, but only when they are presented by the peer.
 connection.advanced.settings.clientauth.label_needed=<b>Needed</b> - A connection cannot be established if the peer does not present a valid certificate.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Certificate chain checking
 connection.advanced.settings.certchain.info=These options configure some aspects of the verification/validation of the certificates that are presented by peers while setting up encrypted connections.

i18n/src/main/resources/openfire_i18n_pt_BR.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=In addition to requiring peers to u
 connection.advanced.settings.clientauth.label_disabled=*Desabilitado* - Os certificados do peer não estão verificados.
 connection.advanced.settings.clientauth.label_wanted=Procurado - Os certificados de peer são verificados, mas somente quando são apresentados pelo mesmo.
 connection.advanced.settings.clientauth.label_needed=*Necessário* - Uma conexão não pode ser estabelecida se o peer não apresentar um certificado válido
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Verificação da cadeia de certificados
 connection.advanced.settings.certchain.info=These options configure some aspects of the verification/validation of the certificates that are presented by peers while setting up encrypted connections.

i18n/src/main/resources/openfire_i18n_pt_PT.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=In addition to requiring peers to u
 connection.advanced.settings.clientauth.label_disabled=<b>Disabled</b> - Peer certificates are not verified.
 connection.advanced.settings.clientauth.label_wanted=<b>Wanted</b> - Peer certificates are verified, but only when they are presented by the peer.
 connection.advanced.settings.clientauth.label_needed=<b>Needed</b> - A connection cannot be established if the peer does not present a valid certificate.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Certificate chain checking
 connection.advanced.settings.certchain.info=These options configure some aspects of the verification/validation of the certificates that are presented by peers while setting up encrypted connections.

i18n/src/main/resources/openfire_i18n_ru_RU.properties

@@ -1584,7 +1584,7 @@ connection.advanced.settings.clientauth.info=В дополнение к треб
 connection.advanced.settings.clientauth.label_disabled=<b>Отключена</b> - Одноранговые сертификаты не проверяются.
 connection.advanced.settings.clientauth.label_wanted=<b>Желательна</b> - Одноранговые сертификаты проверяются, но только тогда, когда они партнеры.
 connection.advanced.settings.clientauth.label_needed=<b>Необходима</b> - Невозможно установить соединение, если абонент не предъявит действительный сертификат.
-connection.advanced.settings.clientauth.label_strict_cert_validation=If attempting to validate a certificate fails, the connection is closed and not attempted via dialback authentication.
+connection.advanced.settings.clientauth.label_strict_cert_validation=Treat invalid TLS certificates as fatal (do not attempt other, possibly weaker, forms methods of authentication).
 connection.advanced.settings.certchain.ocsp.warning=Your server is configured with the Java security property <code>ocsp.enable=false</code> which disables client-driven OCSP certificate revocation checking. While OCSP stapling validation and CRL checking remain active, Openfire will not perform direct OCSP requests to verify certificate status.
 connection.advanced.settings.certchain.boxtitle=Проверка цепочки сертификатов
 connection.advanced.settings.certchain.info=Эти параметры настраивают некоторые аспекты проверки сертификатов, представленных одноранговыми узлами при настройке зашифрованных подключений.