Comment by bart__

https://developer.mozilla.org/en-US/docs/Web/Security/Certif...

As the other commenter already pointed out, Firefox does not require this. Safari and Chrome do. This indeed is not directly applicable to this situation, since XMPP don't involve browsers. But for websites, the parents attack scenario is not applicable.