Check the TLS certificate matches the fingerprint in the key response when connecting to a server over federation (SYN-457)

[matrixbot]

(Imported from https://matrix.org/jira/browse/SYN-457)

(Reported by @NegativeMjark)

[matrixbot]

Jira watchers: @NegativeMjark @richvdh

[matrixbot]

Links exported from Jira:

is duplicated by SYN-84
is duplicated by SYN-460
relates to #1377

[matrixbot]

why is this an important thing to do?

People are setting up their synapses with federation behind reverse-proxies and not telling synapse about the cert. If we ever fix it, we're going to break them. In the meantime, confusion reigns.

-- @richvdh

[matrixbot]

(how do we cope with replacing certs on the reverse-proxy?)

-- @richvdh

[matrixbot]

apparently we check the tls cert on first connection but not thereafter

-- @richvdh

[ara4n]

see also matrix-org/matrix-doc#1685

[richvdh]

MSC1711 proposes that we should instead switch to verifying via Certificate Authorities.