Automatically Identifying Using SSL + CertFP

This page describes how to use SSL with a certificate fingerprint to automatically identify your nick with NickServ on connect. You must have an IRC client that supports SSL with a client certificate.

Creating a Self-signed Certificate

First you need generate a self-signed certificate. We will be using openssl which should be available on most Linux and BSD distributions. There are ports for other platforms including Windows.

Generate the Key and Certificate

We need to generate our certificate and key. We'll use the openssl command with the 'req' option.

% openssl req -nodes -newkey rsa:2048 -keyout nick.key -x509 -days 365 -out nick.cer
Generating a 2048 bit RSA private key
writing new private key to 'nick.key'
-----
Country Name (2 letter code) [US]:YOURCOUNTRYCODE
State or Province Name (full name) [Texas]:YOURSTATE
Locality Name (eg, city) [San Antonio]:YOURCITY
Organization Name (eg, company) [Stealth3]:YOURTEXTHERE
Organizational Unit Name (eg, section) [ISP]:IRC
Common Name (eg, YOUR name) []:YOUR NAME
Email Address []:YOURMAIL@ADDRESS

The fields you are asked to fill out here do not matter for connecting to OFTC so fill them out however you wish. You now have two files, the key in nick.key and the certificate in nick.cer. Remember to protect your key using chmod.

% chmod 400 nick.key

If you are curious, you can have a closer look at your cert. We are mainly interested in the certificate fingerprint (CertFP). (This is not a required step, there are other ways to get the fingerprint.)

% openssl x509 -noout -fingerprint -text < nick.cer

We now combine certificate and key to a single file nick.pem (Remember to also protect this file because it now includes your private key!):

% cat nick.cer nick.key > nick.pem
% chmod 400 nick.pem

Connecting to OFTC with your Cert

Unlisted Clients

If you are using a client that is not listed here feel free to submit a step-by-step howto about it, and we will include it. Either grab a staff member from #oftc or send a mail to our support address support@oftc.net with the information needed. Thank you.

irssi

Move the certificates you created some where safe, for example ~/.irssi/certs.

% mkdir ~/.irssi/certs
% mv nick.{key,cer,pem} ~/.irssi/certs

Grab the root certificate from CAcert to verify the OFTC irc servers.

% wget http://www.cacert.org/certs/root.txt -O ~/.irssi/certs/cacert.pem

Now remove the current server and re-add it with the SSL flag, using your newly generated certificate. Note that we use the SSL port 6697 to connect.

/server remove irc.oftc.net
/network add OFTC
/server add -auto -ssl -ssl_cert ~/.irssi/certs/nick.pem -ssl_cafile ~/.irssi/certs/cacert.pem -ssl_verify -ircnet OFTC irc.oftc.net 6697

Next we need to disconnect and connect back to the server. (A /reconnect does not read the new settings we added.)

/disconnect OFTC
/connect OFTC

To continue please scroll down to read how to add your certificates fingerprint to NickServ.

XChat 2.8

This is known to work with XChat 2.8.x. It does NOT work with prior versions!

Copy the nick.pem file to your .xchat2 directory. The filename must be <network>.pem. In our case this should be OFTC.pem.

% cp nick.pem ~/.xchat2/OFTC.pem

Now start up XChat.

We need to tell XChat to connect via SSL to OFTC.

1. Go to XChat menu and select Network list/.
2. Find OFTC in the list of networks and select edit.
3. Check mark 'Use SSL for all the servers on this network' and 'Accept invalid SSL certificate'.
4. Click 'Close' and then click 'Connect'.

Note: Optionally, we can install the Cacert.org certificates as a trusted source. On Debian or Ubuntu this is as simple as 'sudo apt-get install ca-certificates'. For other OS/distributions see http://wiki.cacert.org/wiki/ImportRootCert.

To continue please scroll down to read how to add your certificates fingerprint to NickServ.

KvIRC

1. Go to "Settings -> Configure KvIRC"

2. Go to "Connection->advanced"

3. On the Tab "SSL" check 'Use ssl certificate' and 'Use SSL private key' and point both to the nick.pem file you created.
4. Change your connection settings and enable the ssl option. Also make sure it is set to connect to port 6697.

To continue please scroll down to read how to add your certificates fingerprint to NickServ.

mIRC (version 6.14 and later)

You need the OpenSSL DLL files to enable SSL functionality in mIRC. You can download them pre-compiled or compile your own. You will need libeay32.dll and ssleay32.dll of OpenSSL 0.9.7d (or newer), and possibly msvcr70d.dll as well. They must be downloaded and placed in the mIRC folder, or in the Windows system folder. OpenSSL source is available from http://www.openssl.org/, you may find links to pre-compiled DLL files at http://www.openssl.org/related/binaries.html.

If mIRC was already running you need to restart it or it wont know about them.

1. Go Main Options Menu -> Connect -> Options

2. Click on the newly appeared SSL button (if it isn't there something is wrong with your OpenSSL installation)
3. Click on the empty box below 'Private Key File', navigate to where you placed your nick.pem file and select it.
4. Do the same for 'Certificate Chain File'

1. Make sure to connect to the network over SSL. This can be done simply now that you have the required DLLs. The command is '/server irc.oftc.net +6697' - note the plus sign before the port number. This is what sets mIRC to connect over SSL. To save this server with the SSL settings, you can simply add the plus sign before the port number in mIRC's server manager.

To continue please scroll down to read how to add your certificates fingerprint to NickServ.

Add your Certificate Fingerprint to your Nick in NickServ

[link] If you did everything right you are now using SSL to connect and should see lines similar to the following in your server window. This will most likely be above the motd so you may have to scroll up a bit to see it.

11:09 !larich.oftc.net *** Connected securely via TLSv1 AES256-SHA-256
11:09 !larich.oftc.net *** Your client certificate fingerprint is: C77106576ABF7F9F90CCA0F63874A60F2E40A64B

This tells us that we are now connected via SSL and that our certificate is working.

To allow NickServ to identify you based on this certificate you need to associate the certificate fingerprint with your nick. To do this issue the command cert add to Nickserv (try /msg nickserv help cert). Please note you must be identified for this command to work (/msg nickserv identify).

/msg nickserv cert add
11:14 -NickServ(services@services.oftc.net)- CERT list entry C77106576ABF7F9F90CCA0F63874A60F2E40A64B added.

Nickserv will message back saying that the CertFP was added. Now the only thing left to do is reconnect to the server to test it out.

/reconnect
11:15 -!- Irssi: Disconnecting from server irc.oftc.net: [Reconnecting]
11:15 -!- Irssi: Connecting to irc.oftc.net [IP ADDRESS] port 6697
11:15 !larich.oftc.net *** Connected securely via TLSv1 AES256-SHA-256
11:15 !larich.oftc.net *** Your client certificate fingerprint is: C77106576ABF7F9F90CCA0F63874A60F2E40A64B
...
11:15 -NickServ(services@services.oftc.net)- You are connected using SSL and have provided a matching client certificate
11:15 -NickServ(services@services.oftc.net)- for nickname jmoocows. You have been automatically identified.
11:15 -!- Mode change [+R] for user jmoocows

Congratulations! You now have automatic identification via SSL and certificate fingerprints!

Benefits?

You may ask yourself what this gets you now. Well, the answer is simple - you can drop any nickserv identify script you have run in the past. As you are identified with your certificate fingerprint you don't need them anymore. And by using SSL, your connection to the irc server is now encrypted.

The servers also use encryption for the server<->server traffic, so if you and those you chat with both use ssl encrypted connections - then the whole traffic between you and them is encrypted.

Questions?

Ask on #oftc or mail support@oftc.net .

irssi does not join some channels on connect

If you find that irssi does not auto-join channels on connect which want you to be identified before you are joining, add -autosendcmd "wait -oftc 2000" to your irssi network settings. This makes irssi wait 2 seconds before any further action, giving services time to identify you.

% /network add -autosendcmd "wait -oftc 2000" OFTC

(In case you are wondering "/network add" is irssi's way of modifying existing networks. /network was called /ircnet in older irssi versions.)

Expired SSL certificates

Client certificates need to be valid. This ensures that user certificates remain reasonably cryptographically strong. If you encounter problems connecting with SSL, ensure that your system's real-time clock is set properly, that your certificate issue date is in the past and that your certificate has not expired.

Last time I tried ssl connection to an IRC network I experienced a huge lag, is that still to be expected?

No. In the early days of supporting ssl connections there were a few problems, as always when you implement new features. Nowadays, ssl support is very stable and reliable. You wont see any difference to a connection without ssl (except having an encrypted connection, of course). All the network operators and lots of other people are using SSL connections to OFTC as their only way to access the network.