NickServ:CertFP

Introduction

This page describes how to connect, and identify yourself to services securely via a certificate fingerprint.

A major advantage of using a CertFP to authenticate is that you don't have to use /msg NickServ IDENTIFY anymore.

By using SSL you are also encrypting the connection between you and the server.

Prerequisites

We will be using OpenSSL to create the certificate. Windows IRC clients will typically include OpenSSL support already, and so usually no additional installation is needed for SSL support on Windows.

Linux

Most Linux distributions already come with the OpenSSL binary and libraries either installed by default or available to be installed from a package management system (e.g apt-get, yum, etc). If neither of these is true for you, you will need to go to the official OpenSSL website, download the sources, and compile it yourself.

Windows

OpenSSL support on Windows is typically included with more recent versions of such clients like mIRC and HexChat. You no longer need to download and install OpenSSL for Windows so long as you are using either mIRC version 7.36 or better, or HexChat for Windows, unless you need to generate a user certificate. Instructions for doing that are below.

Mac

Mac already comes with the OpenSSL binary and libraries installed by default. Locate Keychain Access in your Utilities folder to begin.

Creating the certificate

Once you have verified you have OpenSSL support on your platform, you will need to create a key and certificate.

Linux

For Linux platforms, the following command should be sufficient: openssl req -nodes -newkey rsa:2048 -keyout Xertion.key -x509 -days 365 -out Xertion.cer

Windows

For Windows systems:

• First, go to http://slproweb.com/products/Win32OpenSSL.html and download the latest OpenSSL Light installer. Install to the default location, keeping the default options.
• Click the Start button.
• Type cmd in the search bar, and click on Command Prompt.
• Type in cd C:\OpenSSL-Win32\bin and press Enter.
• Type openssl and press Enter. You should now see an OpenSSL prompt.
• At the prompt, type: req -nodes -newkey rsa:2048 -keyout Xertion.key -x509 -days 365 -out Xertion.cer and press Enter.

Alternatively, you can navigate directly to the Command Prompt if it does not show up when you search for it in the Start Menu - go to Start -> All Programs -> Accessories -> Command Prompt

NOTE: If you get the error

WARNING: can’t open config file: /usr/local/ssl/openssl.cnf

You will need to exit OpenSSL and run the following command in Command Prompt: set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg. Do NOT close the Command Prompt afterwards. After you have executed the command, try generating the key and certificate again.

During certificate generation, you will be asked the following series of questions. Fill these in accordingly - enter your two-letter country code for the country you live in, the state/region/province name you live in + your city. Enter anything you like for organization name and organizational unit name. Use your main IRC nickname for the Common Name field. For Email Address, it does NOT have to be real but SHOULD be in proper email address format of user@domain.tld

Country Name (2 letter code) [US]:
State or Province Name (full name) [Texas]:
Locality Name (eg, city) [San Antonio]:
Organization Name (eg, company) [Stealth3]: Xertion
Organizational Unit Name (eg, section) [ISP]: IRC
Common Name (eg, YOUR name) []:
Email Address []:

Once this information has been entered, two files will then be created - the key and associated certificate - which will need to be combined together.

For Linux, run cat Xertion.cer Xertion.key > Xertion.pem. For Windows, run type Xertion.cer Xertion.key > Xertion.pem

Mac

For Mac operating systems:

• Open Keychain Access from your Utilities folder
• In the list labeled "keychains", select the keychain labeled "login"
• In the main menu, in the top left corner of the screen, open the bold Keychain Access menu. Within this menu, open the Certificate Assistant submenu, then click the menu item labeled Create a Certificate….
• Inside this window, enter a name into the field labeled Name. The name you chose is not important. It is only used to make your certificate easier to find.
• Leave the Identity Type as Self Signed Root
• Change the Certificate Type to SSL Client
• Click Create
• Ignore the You are about to create a self-signed certificate warning by clicking Continue.

Congratulations, you now have an SSL certificate!

Configuring your client

Now that you have your SSL certificate, you will need to configure your client to use it. This step will vary greatly from client to client - some well-known clients are covered below. If your client is not included here, check its documentation to see if it supports client SSL certificates and how to set it up to use one.

KVIrc

Move the Xertion.pem file to a safe place.

• Go to "Settings -> Configure KVIrc"
• Go to "Connection -> Advanced"
• On the Tab "SSL" check "Use SSL certificate" and "Use SSL private key' and point both to the Xertion.pem file you created.
• Change your connection settings and enable the SSL option.

mIRC

Move the Xertion.pem file to a safe place.

• Go to "Main Options Menu -> Connect -> Options"
• Click on the SSL button. If there isn't an SSL button, then you are using an older mIRC version that does not include OpenSSL support, thus you will need to upgrade mIRC before continuing.
• Click on the empty box below "Private Key File", navigate to where you placed your Xertion.pem and select it.
• Do the same for "Certificate Chain File".
• Click OK, then click OK again.

XChat

XChat uses the pem file that corresponds with the name of the network under "Network list". If irc.xertion.org is named under Xertion, then all you have to do is move the Xertion.pem file to ~/.xchat2/Xertion.pem or C:\Users\xxx\AppData\Roaming\X-Chat 2. If it's not named "Xertion", then you will have to either rename the .pem file, or rename the network that irc.xertion.org is listed under so they match each other. Once you are done with that:

• Go to Xchat menu and select "Network List"
• Find Xertion and select "edit".
• Select the boxes "Use SSL for all the servers on this network" and "Accept invalid SSL certificate".
• Click "Close" and then click "Connect".

HexChat

HexChat uses the pem file that corresponds with the name of the network under "Network list". If irc.xertion.org is named under Xertion, then all you have to do is move the Xertion.pem file to ~/.config/hexchat/certs/Xertion.pem or C:\Users\xxx\AppData\Roaming\hexchat\certs. If it's not named "Xertion.pem", then you will have to either rename the .pem file, or rename the network that irc.xertion.org is listed under, so they match each other. Once you are done with that:

• Go to HexChat menu and select "Network List"
• Find Xertion and select "Edit".
• Select the box "Use SSL for all the servers on this network".
• Click "Close" and then click "Connect".

HexChat Documentation

Alternatively, if you choose to use the same .pem file for all networks (not recommended!), you can name the .pem file client.pem in the certs directory.

WeeChat

Move Xertion.pem to ~/.weechat/ssl/Xertion.pem. Create the directory ~/.weechat/ssl beforehand if it doesn't already exist.

The following commands assume your configured IRC network connection is labeled as "Xertion".

Verify SSL is properly configured:

/set irc.server.Xertion.addresses "irc.xertion.org/6697"
/set irc.server.Xertion.ssl on
/set irc.server.Xertion.ssl_dhkey_size 1024
/set irc.server.Xertion.ssl_verify off

Run the following commands for the certificate:

/set irc.server.Xertion.ssl_cert "%h/ssl/Xertion.pem"

If you're using a vhost, you'll most likely also need to set the following options to delay autojoin, so that the vhost can kick in before joining:

/set irc.server.Xertion.command "/mute"
/set irc.server.Xertion.command_delay 1

The above can also be set using the interactive iset perl script.

irssi

• Move the cert to ~/.irssi/certs/Xertion.pem
• Use the command /server add -ssl -ssl_cert ~/.irssi/certs/Xertion.pem -network Xertion irc.xertion.org 6697

If you find that irssi does not auto-join channels on connect which want you to be identified before you are joining, add -autosendcmd "wait -xertion 2000" to your irssi network settings. This makes irssi wait 2 seconds before any further action, giving services time to identify you.

Command: /network add -autosendcmd "wait -xertion 2000" Xertion

Textual

• Begin by opening Server Properties using the keyboard combination Command U.
• In the window that appears, click Client Certificate under the Advanced section of the navigation list.
• Inside this window, click the Select Certificate button. A list of certificates will appear.
• Select the certificate that you created.
• Click the Chose button to continue. Server Properties will update the window to confirm your selection:
• Finish by clicking the Save button.

ZNC

• Ensure the Cert module is loaded.
• Log in to your web admin panel, go to the User Modules section, and select "Certificate".
• Copy the contents of the .pem file you created into the edit box and apply the changes.
• Reconnect your ZNC to the IRC network.

Now when you connect to Xertion, you should see something like this appear:

*** You are connected using SSL cipher "DHE-RSA-AES-256-CBC-SHA1" and your SSL fingerprint is xxxxxxxxxxxxxxxxxxxxxxx

If you see that message, then everything is configured properly and your client SSL certificate has been read in successfully. You are now ready to add this information to NickServ.

Add the certificate fingerprint to NickServ

Once you are connected with your SSL certificate, you will need to add its fingerprint to NickServ to be able to identify with it. Follow these steps:

• Identify yourself to services with your password: /msg NickServ IDENTIFY password
• Then, type (or copy/paste) this command: /msg NickServ CERT ADD. This will automatically add your current SSL certificate fingerprint to NickServ.

You're done! You no longer need any NickServ auto-authentication commands; you can safely disable those now. Keep your NickServ password handy just in case, though. Test it by reconnecting to the network. If everything was done correctly you should now be identified by services automatically using your SSL client certificate fingerprint - look for the following notice from NickServ:

-NickServ- SSL certificate fingerprint accepted - you are now recognized.

If you have any questions, feel free to join #help and ask.

See Also

Main Page: NickServ

Return to Main Page