Some XMPP servers have the capability of hosting multiple domains on the same IP address. When connecting to that IP address, Openfire should (but apparently does not) send along a “server name indication” to connect to the intended domain.

This problem has been observed when trying to connect to the XMPP domain millesimus.de

Openfire connects to IP 173.212.205.87 and receives a TLS certificate that is issued for (subdomains of) politicalsciences.eu, which is a different XMPP service hosted on the same server.

The issue can be reproduced with openssl:

openssl s_client -connect 173.212.205.87:5270 will return a certificate for politicalsciences.eu

openssl s_client -connect xmpp.millesimus.de:5270 will return a certificate for millesimus.de

Openfire should be modified to send along the proper SNI when connecting to a remote server.