MSN + Pidgin + omega.contacts.msn.com

/
Tags:

Pidgin users with MSN accounts may have been experiencing problems connecting. It seems they have changed their certificate. The solution seems to be to manually delete the certificate, either by going to "Menu -> Tools -> Certificates" or by doing something like:

rm .purple/certificates/x509/tls_peers/omega.contacts.msn.com In my case I used "mv" so I could keep the old ones for reference..

It seemed to work, but then the next day I had to do it again, I checked the certificates and found out the following:

The certificate that expired was valid from Tue Dec 1 22:45:11 2009 till Wed Dec 1 22:45:11 2010. The one I got the other day after moving this one is valid from Wed Jun 23 03:06:48 2010 till Thu Jun 23 03:06:48 2011, and after getting the same issue again and mv again the certificate I received a new one valid from Mon Nov 15 22:28:19 2010 till Wed Nov 14 22:28:19 2012.. .

I am going to guess there is an issue with their servers not using the same key every time, and I am going to guess that the official MSN client uses more than one certificate so it can switch from one to another depending on the server you connect to with giving the user any alert. .. .(yeah this does seem to not fit with the whole idea of the certificate.. . then again what do I know).. anyway, the three certs I got so far have these SHA1 fingerprints:

The one I originally had
f3:1f:2c:78:6a:8f:97:a6:8d:a8:c9:d4:0a:af:64:ae:63:57:88:17
The one I got a couple of days ago
c8:f3:b1:69:52:36:07:33:b5:02:1b:a2:b2:b4:ce:32:b9:68:37:36
The one I just got now
ac:7e:e4:5f:97:b8:7e:f0:0b:ac:a6:51:9f:ba:51:f0:ad:73:17:8b

It almost looks like MSN got a Man In The Middle attack or something strange like that, maybe their private key got leaked so they changed it quickly thinking nobody would notice ? No official information to be found (if someone knows of any official information let me know).

Update

It seems that there is a patch for Ubuntu and it seems their solution was to manually add certs and stuff like that.. All this because MSN has/had an issue with their servers issuing different certificates at the same time.. Or something like that (MITM)..