Subject: OFTC: Automatically Identifying Using SSL + CertFP

Date: Tue, 19 May 2015 19:26:57 +0200

=3D3DC3=3D3DAF=3D3DC2=3D3DBB=3D3DC2=3D3DBF<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv=3D3D3D"Content-Type" content=3D3D3D"text/html;charset=
=3D3D3D=3D
utf-8">
    <meta name=3D3D3D"robots" content=3D3D3D"index,follow">
    <title>OFTC - NickServ/CertFP</title>
    <meta name=3D3D3D"viewport" content=3D3D3D"width=3D3D3Ddevice-width, in=
itial-=3D
scale=3D3D
=3D3D3D1.0">
    <link href=3D3D3D"/img/oftc-16.png" rel=3D3D3D"shortcut icon" type=3D3D=
3D"ima=3D
ge/png=3D3D
" />
    <link href=3D3D3D"/css/bootstrap.min.css" rel=3D3D3D"stylesheet" media=
=3D3D3D=3D
"scree=3D3D
n">
    <link href=3D3D3D"/css/main.css" rel=3D3D3D"stylesheet">
    <script src=3D3D3D"http://code.jquery.com/jquery.js"></script>
    <script src=3D3D3D"/js/bootstrap.min.js"></script>
    <script src=3D3D3D"/js/main.js"></script>
   =3D3D20
  </head>

  <body>
    <div class=3D3D3D"navbar navbar-fixed-top">
      <div class=3D3D3D"navbar-inner">
        <div class=3D3D3D"container">
          <form class=3D3D3D"navbar-form pull-right" action=3D3D3D"//webcha=
t.of=3D
tc.n=3D3D
et" method=3D3D3D"get" target=3D3D3D"_blank">
            <input name=3D3D3D"nick" type=3D3D3D"text" data-toggle=3D3D3D"t=
ooltip=3D
" titl=3D3D
e=3D3D3D"Enter your IRC nickname" class=3D3D3D"span2" placeholder=3D3D3D"Ni=
ckname=3D
">
            <input name=3D3D3D"channels" type=3D3D3D"text" data-toggle=3D3D=
3D"too=3D
ltip" =3D3D
title=3D3D3D"Enter comma seperated list of channels to join" class=3D3D3D"s=
pan2=3D
" pl=3D3D
aceholder=3D3D3D"#oftc, #moocows">
            <input type=3D3D3D"hidden" name=3D3D3D"uio" value=3D3D3D"d4">
            <button type=3D3D3D"submit" class=3D3D3D"btn">Chat!</button>
          </form>
          <button type=3D3D3D"button" class=3D3D3D"btn btn-navbar" data-tog=
gle=3D
=3D3D3D"c=3D3D
ollapse" data-target=3D3D3D".nav-collapse">
            <span class=3D3D3D"icon-bar"></span>
            <span class=3D3D3D"icon-bar"></span>
            <span class=3D3D3D"icon-bar"></span>
          </button>
          <a class=3D3D3D"brand" href=3D3D3D"/">OFTC</a>
          <div class=3D3D3D"nav-collapse collapse">
            <ul class=3D3D3D"nav">
             =3D3D20
                <li><a href=3D3D3D"/">Home</a></li>
             =3D3D20
             =3D3D20
                <li><a href=3D3D3D"/constitution">Constitution</a></li>
             =3D3D20
             =3D3D20
                <li><a href=3D3D3D"/staff">Staff</a></li>
             =3D3D20
             =3D3D20
                <li><a href=3D3D3D"/departments">Departments</a></li>
             =3D3D20
             =3D3D20
                <li><a href=3D3D3D"/FAQ">FAQ</a></li>
             =3D3D20
            </ul>
          </div><!--/.nav-collapse -->
        </div>
      </div>
    </div>
    <article>
    <div class=3D3D3D"container">
      <div class=3D3D3D"row-fluid">
       <div class=3D3D3D"span12">
          <ul id=3D3D3D"markdown-toc">
  <li><a href=3D3D3D"#automatically-identifying-using-ssl--certfp">Automati=
ca=3D
ll=3D3D
y Identifying Using SSL + CertFP</a>    <ul>
      <li><a href=3D3D3D"#creating-a-self-signed-certificate">Creating a Se=
lf=3D
-s=3D3D
igned Certificate</a>        <ul>
          <li><a href=3D3D3D"#generate-the-key-and-certificate">Generate th=
e =3D
Ke=3D3D
y and Certificate</a></li>
        </ul>
      </li>
      <li><a href=3D3D3D"#connecting-to-oftc-with-your-cert">Connecting to =
OF=3D
TC=3D3D
 with your Cert</a>        <ul>
          <li><a href=3D3D3D"#unlisted-clients">Unlisted Clients</a></li>
          <li><a href=3D3D3D"#irssi">irssi</a></li>
          <li><a href=3D3D3D"#xchat-28">XChat 2.8</a></li>
          <li><a href=3D3D3D"#kvirc">KvIRC</a></li>
          <li><a href=3D3D3D"#mirc-version-614-and-later">mIRC (version 6.1=
4 =3D
an=3D3D
d later)</a></li>
          <li><a href=3D3D3D"#chatzilla">ChatZilla</a></li>
          <li><a href=3D3D3D"#znc">ZNC</a></li>
          <li><a href=3D3D3D"#quassel">Quassel</a></li>
          <li><a href=3D3D3D"#emacserc">Emacs/ERC</a></li>
          <li><a href=3D3D3D"#weechat">weechat</a></li>
        </ul>
      </li>
      <li><a href=3D3D3D"#add-your-certificate-fingerprint-to-your-nick-in-=
ni=3D
ck=3D3D
serv">Add your Certificate Fingerprint to your Nick in NickServ</a></li>
      <li><a href=3D3D3D"#benefits">Benefits</a></li>
      <li><a href=3D3D3D"#questions">Questions</a>        <ul>
          <li><a href=3D3D3D"#irssi-does-not-join-some-channels-on-connect"=
>i=3D
rs=3D3D
si does not join some channels on connect</a></li>
          <li><a href=3D3D3D"#expired-ssl-certificates">Expired SSL certifi=
ca=3D
te=3D3D
s</a></li>
          <li><a href=3D3D3D"#last-time-i-tried-ssl-connection-to-an-irc-ne=
tw=3D
or=3D3D
k-i-experienced-a-huge-lag-is-that-still-to-be-expected">Last time I tried =
=3D
=3D3D
ssl connection to an IRC network I experienced a huge lag, is that still to=
=3D
=3D3D
 be expected?</a></li>
        </ul>
      </li>
    </ul>
  </li>
</ul>

<h1 id=3D3D3D"automatically-identifying-using-ssl--certfp">Automatically Id=
en=3D
ti=3D3D
fying Using SSL + CertFP</h1>

<p>This page describes how to use SSL with a certificate fingerprint to
automatically identify your registered nickname with NickServ on connect. Y=
=3D
=3D3D
ou
must have an IRC client that supports SSL with a client certificate.</p>

<h2 id=3D3D3D"creating-a-self-signed-certificate">Creating a Self-signed Ce=
rt=3D
if=3D3D
icate</h2>

<p>First you need generate a self-signed certificate.  We will be using Ope=
=3D
=3D3D
nSSL
which should be available on most Linux and BSD distributions. There are po=
=3D
=3D3D
rts
for other platforms including Windows.</p>

<h3 id=3D3D3D"generate-the-key-and-certificate">Generate the Key and Certif=
ic=3D
at=3D3D
e</h3>

<p>We need to generate our certificate and key. We&#8217;ll use the <strong=
=3D
=3D3D
>openssl</strong> command
with the &#8216;req&#8217; option.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% openssl req -n=
odes=3D
 -ne=3D3D
wkey rsa:2048 -keyout nick.key -x509 -days 3650 -out nick.cer
Generating a 2048 bit RSA private key
writing new private key to &#39;nick.key&#39;
-----
Country Name (2 letter code) [US]:YOURCOUNTRYCODE
State or Province Name (full name) [Texas]:YOURSTATE
Locality Name (eg, city) [San Antonio]:YOURCITY
Organization Name (eg, company) [Stealth3]:YOURTEXTHERE
Organizational Unit Name (eg, section) [ISP]:IRC
Common Name (eg, YOUR name) []:YOUR NAME
Email Address []:YOURMAIL@ADDRESS
</code></pre></div>

<p>The fields you are asked to fill out here do not matter for connecting t=
=3D
=3D3D
o OFTC
so fill them out however you wish. (You can use other key sizes if you want=
=3D
=3D3D
, but
the hash algorithm needs to be SHA-1.) You now have two files, the key in
<strong>nick.key</strong> and the certificate in <strong>nick.cer</strong>.=
=3D
=3D3D
 Remember to protect your key
using chmod.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% chmod 400 nick=
.key
</code></pre></div>

<p>If you are curious, you can have a closer look at your cert. We are main=
=3D
=3D3D
ly
interested in the certificate fingerprint (CertFP). (This is not a required
step, there are other ways to get the fingerprint.)</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% openssl x509 -=
noou=3D
t -f=3D3D
ingerprint -text &lt; nick.cer
</code></pre></div>

<p>We now combine certificate and key to a single file <strong>nick.pem</st=
=3D
=3D3D
rong> (Remember to
also protect this file because it now includes your private key!):</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% cat nick.cer n=
ick.=3D
key =3D3D
&gt; nick.pem
% chmod 400 nick.pem
</code></pre></div>

<h2 id=3D3D3D"connecting-to-oftc-with-your-cert">Connecting to OFTC with yo=
ur=3D
 C=3D3D
ert</h2>

<h3 id=3D3D3D"unlisted-clients">Unlisted Clients</h3>

<p>If you are using a client that is not listed here feel free to submit a
step-by-step howto about it, and we will include it. Either grab a staff me=
=3D
=3D3D
mber
from #oftc or send a mail to our support address [email-masked]  with the
information needed. Thank you.</p>

<h3 id=3D3D3D"irssi">irssi</h3>

<p>Move the certificates you created some where safe, for example ~/.irssi/=
=3D
=3D3D
certs.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% mkdir ~/.irssi=
/cer=3D
ts
% mv nick.{key,cer,pem} ~/.irssi/certs
</code></pre></div>

<p>Grab the root certificate from SPI to verify the OFTC irc servers.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% wget http://ww=
w.sp=3D
i-in=3D3D
c.org/ca/spi-cacert.crt -O ~/.irssi/certs/spi.pem
% ln -s spi.pem ~/.irssi/certs/CAs.pem
</code></pre></div>

<p>Now remove the current server and re-add it with the <strong>SSL</strong=
=3D
=3D3D
> flag, using your
newly generated certificate. Note that we use the SSL port <strong>6697</st=
=3D
=3D3D
rong> to connect.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">/server remove i=
rc.o=3D
ftc.=3D3D
net
/network add OFTC
/server add -auto -ssl -ssl_cert ~/.irssi/certs/nick.pem -ssl_cafile ~/.irs=
=3D
=3D3D
si/certs/CAs.pem -ssl_verify -network OFTC irc.oftc.net 6697
</code></pre></div>

<p>Next we need to disconnect and connect back to the server. (A /reconnect=
=3D
=3D3D
 does
<strong>not</strong> read the new settings we added.)</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">/disconnect OFTC
/connect OFTC
</code></pre></div>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"xchat-28">XChat 2.8</h3>

<p>This is known to work with XChat 2.8.x. It does <strong>NOT</strong> wor=
=3D
=3D3D
k with prior
versions!</p>

<p>Copy the nick.pem file to your .xchat2 directory. The filename must be
<code>&lt;network&gt;.pem</code>.  In our case this should be <strong>OFTC.=
=3D
=3D3D
pem</strong>. On Windows, the
directory is something like C:\Documents and Settings(user)\Application
Data\X-Chat 2.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% cp nick.pem ~/=
.xch=3D
at2/=3D3D
OFTC.pem
</code></pre></div>

<p>Now start up XChat.</p>

<p>We need to tell XChat to connect via SSL to OFTC.</p>

<ol>
  <li>Go to XChat menu and select Network list/.</li>
  <li>Find OFTC in the list of networks and select edit.</li>
  <li>Check mark &#8216;Use SSL for all the servers on this
network&#8217; and &#8216;Accept invalid SSL certificate&#8217;.</li>
  <li>Click &#8216;Close&#8217; and then click &#8216;Connect&#8217;.</li>
</ol>

<p><img src=3D3D3D"../xchat-settings-1.png" alt=3D3D3D"xchat" /></p>

<p><em>Note:</em> Optionally, we can install SPI&#8217;s root certificates =
=3D
=3D3D
as a trusted source.
On Debian or Ubuntu this is as simple as &#8216;sudo apt-get install ca-cer=
=3D
=3D3D
tificates&#8217;.
For other OS/distributions get
<a href=3D3D3D"http://www.spi-inc.org/ca/spi-cacert.crt">http://www.spi-inc=
.o=3D
rg=3D3D
/ca/spi-cacert.crt</a>.</p>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"kvirc">KvIRC</h3>

<ol>
  <li>Go to &#8220;Settings -&gt; Configure KvIRC&#8221;</li>
  <li>Go to &#8220;Connection-&gt;advanced&#8221;</li>
  <li>On the Tab &#8220;SSL&#8221; check &#8216;Use ssl certificate&#8217; =
=3D
=3D3D
and &#8216;Use SSL private key&#8217; and
point both to the nick.pem file you created.</li>
  <li>Change your connection settings and enable the ssl option. Also make =
=3D
=3D3D
sure
it is set to connect to port 6697.</li>
</ol>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"mirc-version-614-and-later">mIRC (version 6.14 and later)</h3>

<p>You need the OpenSSL DLL files to enable SSL functionality in mIRC. You =
=3D
=3D3D
can
download them pre-compiled or compile your own. You will need libeay32.dll =
=3D
=3D3D
and
ssleay32.dll of OpenSSL 0.9.7d (or newer), and possibly msvcr70d.dll as wel=
=3D
=3D3D
l.
They must be downloaded and placed in the mIRC folder, or in the Windows sy=
=3D
=3D3D
stem
folder. OpenSSL source is available from http://www.openssl.org/, you may f=
=3D
=3D3D
ind
links to pre-compiled DLL files at http://www.openssl.org/related/binaries.=
=3D
=3D3D
html.</p>

<p>If mIRC was already running you need to restart it or it wont know about=
=3D
=3D3D
 them.</p>

<ol>
  <li>Go Main Options Menu -&gt; Connect -&gt; Options</li>
  <li>Click on the newly appeared SSL button (if it isn&#8217;t there somet=
=3D
=3D3D
hing is
wrong with your OpenSSL installation)</li>
  <li>Click on the empty box below &#8216;Private Key File&#8217;, navigate=
=3D
=3D3D
 to where you
placed your nick.pem file and select it.</li>
  <li>Do the same for &#8216;Certificate Chain File&#8217;</li>
</ol>

<p><img src=3D3D3D"../mirc-ssl.png" alt=3D3D3D"mirc" /></p>

<ol>
  <li>Make sure to connect to the network over SSL. This can be done simply=
=3D
=3D3D
 now
that you have the required DLLs. The command is &#8216;/server irc.oftc.net=
=3D
=3D3D
 +6697&#8217; -
note the plus sign before the port number. This is what sets mIRC to connect
over SSL. To save this server with the SSL settings, you can simply add the=
=3D
=3D3D
 plus
sign before the port number in mIRC&#8217;s server manager.</li>
</ol>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"chatzilla">ChatZilla</h3>

<ol>
  <li>Convert the key to pkcs12: openssl pkcs12 -export -out nick.pfx -in n=
=3D
=3D3D
ick.pem</li>
  <li>Go to the Certificate Manager. You should find that in the Preference=
=3D
=3D3D
s,
Advanced Options, Encryption. Select &#8216;View Certificates&#8217; and th=
=3D
=3D3D
ere you can
import the nick.pfx you just generated</li>
  <li>Now connect to OFTC using SSL and Chat<em>**</em>Zilla asks if you wa=
=3D
=3D3D
nt to use the
certificate for authentication. Say yes. (Note that you will have to confirm
sending the certificate once for every server you connect to. As irc.oftc.n=
=3D
=3D3D
et is
a rotation it might ask you later again, don&#8217;t be surprised).</li>
</ol>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"znc">ZNC</h3>

<ol>
  <li>Follow the instructions found on http://en.znc.in/wiki/Cert
    <ul>
      <li>This should not be confused with http://en.znc.in/wiki/Certauth w=
=3D
=3D3D
hich is
used to authenticate your remote client to your instance of znc. You&#8217;=
=3D
=3D3D
re trying
to authenticate your znc instance with OFTC.</li>
    </ul>
  </li>
</ol>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"quassel">Quassel</h3>

<p>Quassel settings are stored in ~/.config/quassel-irc.org/ so we can make=
=3D
=3D3D
 the
certs in ~/.config/quassel-irc.org/certs/ .</p>

<p>In the =3D3DC3=3D3DA2=3D3DC2=3D3D80=3D3DC2=3D3D9CSettings -&gt; Configur=
e Quassel =3D
=3D3DC3=3D3DA2=3D3DC2=3D3D80=3D3D
=3D3DC2=3D3D9C menu, the =3D3DC3=3D3DA2=3D3DC2=3D3D80=3D3DC2=3D3D9CIdentiti=
es=3D3DC3=3D3DA2=3D3DC=3D
2=3D3D80=3D3DC2=3D3D9D section,
=3D3DC3=3D3DA2=3D3DC2=3D3D80=3D3DC2=3D3D9CAdvanced=3D3DC3=3D3DA2=3D3DC2=3D3=
D80=3D3DC2=3D3D9D tab co=3D
ntains the interface to =3D3D
indicate the certificate.</p>

<ol>
  <li>Load the key (~/.config/quassel-irc.org/certs/mynick.key)</li>
  <li>Load the certificate (~/.config/quassel-irc.org/certs/mynick.pem)</li>
  <li>Click OK and re-connect to the network.</li>
</ol>

<p><img src=3D3D3D"../quassel-identities.png" alt=3D3D3D"quassel" /></p>

<p>You (obviously) need to be using an SSL port for this to work.
http://bugs.quassel-irc.org/projects/1/wiki#IRC-Configuration has some deta=
=3D
=3D3D
il on
server settings interface.</p>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"emacserc">Emacs/ERC</h3>

<p>Get the root certificate from SPI and move it to a safe place, for examp=
=3D
=3D3D
le
~/.ssl. </p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% mkdir ~/.ssl/c=
erts
% wget http://www.spi-inc.org/ca/spi-cacert.crt -O ~/.ssl/spi_ca.pem
</code></pre></div>

<p>Do the same with the certificate you created.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% mv nick.pem ~/=
.ssl/
</code></pre></div>

<p>Now start up Emacs and customize the tls-program variable (e.g. by calli=
=3D
=3D3D
ng &#8220;M-x
customize-variable&#8221; and entering &#8220;tls-program&#8221;).</p>

<p>In order to connect with gnutls-cli, add the following entry:</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">gnutls-cli --pri=
orit=3D
y SE=3D3D
CURE256 --x509cafile ~/.ssl/spi_ca.pem --x509certfile ~/.ssl/erc_nick.pem -=
=3D
=3D3D
p %p %h
</code></pre></div>

<p>In order to connect with openssl, add the following entry:</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">openssl s_client=
 -co=3D
nnec=3D3D
t %h:%p -no_ssl2 -ign_eof -CAfile ~/.ssl/spi_ca.pem -cert ~/.ssl/erc_nick.p=
=3D
=3D3D
em=3D3D20
</code></pre></div>

<p>Then call &#8220;M-x erc-tls&#8221; and connect to irc.oftc.net, port 66=
=3D
=3D3D
97.</p>

<p>More info on using SSL in ERC can be found at <a href=3D3D3D"http://www.=
em=3D
ac=3D3D
swiki.org/emacs/ErcSSL">the
EmacsWiki</a>.</p>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<h3 id=3D3D3D"weechat">weechat</h3>

<p>Move the certificates you created some where safe, for example ~/.weecha=
=3D
=3D3D
t/certs.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% mkdir ~/.weech=
at/c=3D
erts
% mv nick.{key,cer,pem} ~/.weechat/certs
</code></pre></div>

<p>Grab the root certificate from SPI to verify the OFTC irc servers.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% wget http://ww=
w.sp=3D
i-in=3D3D
c.org/ca/spi-cacert.crt -O ~/.weechat/certs/spi.pem
% ln -s spi.pem ~/.weechat/certs/CAs.pem
</code></pre></div>

<p>Now disconnect and remove the current server. Re-add it with the SSL fla=
=3D
=3D3D
g, using
your newly generated certificate. Note that we use the SSL port 6697 to con=
=3D
=3D3D
nect.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">/disconnect OFTC
/server del OFTC
/server add OFTC irc.oftc.net/6697 -ssl -ssl_verify -autoconnect
/set irc.server.OFTC.ssl_cert %h/certs/nick.pem
</code></pre></div>

<p>You may need to set the weechat.network.gnutls_ca_file variable.</p>

<p>Now connect back to the server.</p>

<p><code>/connect OFTC</code></p>

<p>To continue please scroll down to <a href=3D3D3D"#AddCertFPtoNS">read ho=
w =3D
to=3D3D
 add your certificates fingerprint
to NickServ.</a></p>

<p><a id=3D3D3D"AddCertFPtoNS"></a></p>

<h2 id=3D3D3D"add-your-certificate-fingerprint-to-your-nick-in-nickserv">Ad=
d =3D
yo=3D3D
ur Certificate Fingerprint to your Nick in NickServ</h2>

<p>If you did everything right you are now using SSL to connect and should =
=3D
=3D3D
see
lines similar to the following in your server window. This will most likely=
=3D
=3D3D
 be
above the motd so you may have to scroll up a bit to see it.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">11:09 !larich.of=
tc.n=3D
et *=3D3D
** Connected securely via TLSv1 AES256-SHA-256
11:09 !larich.oftc.net *** Your client certificate fingerprint is: C7710657=
=3D
=3D3D
6ABF7F9F90CCA0F63874A60F2E40A64B
</code></pre></div>

<p>This tells us that we are now connected via SSL and that our certificate=
=3D
=3D3D
 is
working.</p>

<p>To allow NickServ to identify you based on this certificate you need to
associate the certificate fingerprint with your nick. To do this issue the
command <strong>cert add</strong> to Nickserv (try /msg nickserv help cert)=
=3D
=3D3D
. Please note you
must be <strong>identified</strong> for this command to work (/msg nickserv=
=3D
=3D3D
 identify).</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">/msg nickserv ce=
rt a=3D
dd
11:14 -NickServ([email-masked])- CERT list entry C77106576ABF7F=
=3D
=3D3D
9F90CCA0F63874A60F2E40A64B added.
</code></pre></div>

<p>Nickserv will message back saying that the CertFP was added.  Now the on=
=3D
=3D3D
ly thing
left to do is reconnect to the server to test it out.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">/reconnect
11:15 -!- Irssi: Disconnecting from server irc.oftc.net: [Reconnecting]
11:15 -!- Irssi: Connecting to irc.oftc.net [IP ADDRESS] port 6697
11:15 !larich.oftc.net *** Connected securely via TLSv1 AES256-SHA-256
11:15 !larich.oftc.net *** Your client certificate fingerprint is: C7710657=
=3D
=3D3D
6ABF7F9F90CCA0F63874A60F2E40A64B
...
11:15 -NickServ([email-masked])- You are connected using SSL an=
=3D
=3D3D
d have provided a matching client certificate
11:15 -NickServ([email-masked])- for nickname jmoocows. You hav=
=3D
=3D3D
e been automatically identified.
11:15 -!- Mode change [+R] for user jmoocows
</code></pre></div>

<p><strong>Congratulations!</strong> You now have automatic identification =
=3D
=3D3D
via SSL and
certificate fingerprints!</p>

<h2 id=3D3D3D"benefits">Benefits</h2>

<p>You may ask yourself what this gets you now. Well, the answer is simple =
=3D
=3D3D
- you
can drop any nickserv identify script you have run in the past. As you are
identified with your certificate fingerprint you don&#8217;t need them anym=
=3D
=3D3D
ore. And by
using SSL, your connection to the irc server is now encrypted.</p>

<p>The servers also use encryption for the server&lt;-&gt;server traffic, s=
=3D
=3D3D
o if you and
those you chat with both use ssl encrypted connections - then the whole tra=
=3D
=3D3D
ffic
between you and them is encrypted.</p>

<h2 id=3D3D3D"questions">Questions</h2>

<p>Ask on #oftc or mail [email-masked] .</p>

<h3 id=3D3D3D"irssi-does-not-join-some-channels-on-connect">irssi does not =
jo=3D
in=3D3D
 some channels on connect</h3>

<p>If you find that irssi does not auto-join channels on connect which want=
=3D
=3D3D
 you to
be identified before you are joining, add <strong>-autosendcmd &#8220;wait =
=3D
=3D3D
-oftc 2000&#8221;</strong> to
your irssi network settings. This makes irssi wait 2 seconds before any fur=
=3D
=3D3D
ther
action, giving services time to identify you.</p>

<div class=3D3D3D"highlight"><pre><code class=3D3D3D"text">% /network add -=
auto=3D
send=3D3D
cmd &quot;wait -oftc 2000&quot; OFTC
</code></pre></div>

<p>(In case you are wondering &#8220;/network add&#8221; is irssi&#8217;s w=
=3D
=3D3D
ay of modifying existing
networks. /network was called /ircnet in older irssi versions.)</p>

<h3 id=3D3D3D"expired-ssl-certificates">Expired SSL certificates</h3>

<p>Client certificates need to be valid. This ensures that user certificate=
=3D
=3D3D
s remain
reasonably cryptographically strong. If you encounter problems connecting w=
=3D
=3D3D
ith
SSL, ensure that your system&#8217;s real-time clock is set properly, that =
=3D
=3D3D
your
certificate issue date is in the past and that your certificate has not exp=
=3D
=3D3D
ired.</p>

<h3 id=3D3D3D"last-time-i-tried-ssl-connection-to-an-irc-network-i-experien=
ce=3D
d-=3D3D
a-huge-lag-is-that-still-to-be-expected">Last time I tried ssl connection t=
=3D
=3D3D
o an IRC network I experienced a huge lag, is that still to be expected?</h=
=3D
=3D3D
3>

<p>No. In the early days of supporting ssl connections there were a few pro=
=3D
=3D3D
blems,
as always when you implement new features. Nowadays, ssl support is very st=
=3D
=3D3D
able
and reliable.  You wont see any difference to a connection without ssl (exc=
=3D
=3D3D
ept
having an encrypted connection, of course). All the network operators and l=
=3D
=3D3D
ots
of other people are using SSL connections to OFTC as their only way to acce=
=3D
=3D3D
ss
the network.</p>

        </div>
      </div>
    </div> <!-- /container -->
    </article>
  </body>
</html>