NickServ:CertFP

Introduction

This page describes how to connect, and identify yourself to services securely via a certificate fingerprint.

A major advantage of using a CertFP to authenticate is that you don't have to use /msg NickServ IDENTIFY anymore.

By using SSL you are also encrypting the connection between you and the server.

Creating the certificate

OpenSSL

We will be using OpenSSL to create the certificate. If you haven't already, please install OpenSSL using these instructions:

Windows

Download OpenSSL v1.0.1c, which was current at the time. Along with Visual C++ 2008 Redistributables. I'm using Windows 7 so please note that you should select "The Windows system directory" when it asks you where to copy the dll files to, or it may not work.

Linux

Most distributions come with OpenSSL. If they don't, please go to http://www.openssl.org/ and install.

Generating a .pem

To generate the required .pem file, you will need to create a key and a certificate first:

Linux

openssl req -nodes -newkey rsa:2048 -keyout Xertion.key -x509 -days 365 -out Xertion.cer

Windows

• Go to Start
• Type cmd in the search bar
• Open Command Prompt
• Type in cd C:\OpenSSL-Win32\bin and hit return.
• Type openssl and hit return.
• You should now see something along the lines of OpenSSL>
• Type in the following req -nodes -newkey rsa:2048 -keyout Xertion.key -x509 -days 365 -out Xertion.cer

If you receive the following error:

WARNING: can’t open config file: /usr/local/ssl/openssl.cnf

You'll need to close OpenSSL and type in the following and restart OpenSSL:

set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg

After entering the command(s), you will be asked these questions, fill them in like so.

Country Name (2 letter code) [US]:US
State or Province Name (full name) [Texas]:New York
Locality Name (eg, city) [San Antonio]:Manhattan
Organization Name (eg, company) [Stealth3]: Xertion
Organizational Unit Name (eg, section) [ISP]: IRC
Common Name (eg, YOUR name) []:Kaishiro
Email Address []:noreply@xertion.org

This will create two files, which you will need to combine together.

Linux

cat Xertion.cer Xertion.key > Xertion.pem

Windows

type Xertion.cer Xertion.key > Xertion.pem

Configuring your client

This section varies highly from client to client.

KVIrc

Move the Xertion.pem file to a safe place.

• Go to "Settings -> Configure KVIrc"
• Go to "Connection -> advanced"
• On the Tab "SSL" check "Use ssl certificate" and "Use SSL private key' and point both to the Xertion.pem file you created.
• Change your connection settings and enable the SSL option.

mIRC

Move the Xertion.pem file to a safe place. Make sure you can connect using ssl. If not, then go here http://www.mirc.com/ssl.html

• Go to "Main Options Menu -> Connect -> Options"
• Click on the SSL button, if there isn't one, then you didn't install ssl properly.
• Click on the empty box below "Private Key File", navigate to where you placed your Xertion.pem and select it.
• Do the same for "Certificate Chain File"

XChat

XChat uses the pem file that corresponds with the name of the network under "Network list". If irc.xertion.org is named under Xertion, then all you have to do is move the Xertion.pem file to ~/.xchat2/Xertion.pem or C:\Users\xxx\AppData\Roaming\X-Chat 2. If it's not named "Xertion", then you will have to either rename the .pem file, or rename the network that irc.xertion.org is listen under so they match each other. Once you are done with that:

• Go to Xchat menu and select "Network List"
• Find Xertion and select "edit".
• Select the boxes "Use SSL for all the servers on this network" and "Accept invalid SSL certificate".
• Click "Close" and then click "Connect".

WeeChat

Move Xertion.pem to ~/.weechat/ssl/Xertion.pem. Create directiory ~/.weechat/ssl beforehand if it doesn't exist

Assuming your network is labeled as "Xertion"...

Verify SSL is properly configured:

/set irc.server.Xertion.addresses "irc.xertion.org/6697"
/set irc.server.Xertion.ssl on
/set irc.server.Xertion.ssl_dhkey_size 1024
/set irc.server.Xertion.ssl_verify off

Run the following commands for the certificate:

/set irc.server.Xertion.ssl_cert "%h/ssl/Xertion.pem"

If you're using a vhost, you'll most likely also need to set the following options to delay autojoin, so that the vhost can kick in before joining:

/set irc.server.Xertion.command "/mute"
/set irc.server.Xertion.command_delay 1

The above can also be set using the interactive iset perl script.

irssi

• Move the cert to ~/.irssi/certs/Xertion.pem
• Use the command /server add -ssl -ssl_cert ~/.irssi/certs/Xertion.pem -network Xertion irc.xertion.org 6697

If you find that irssi does not auto-join channels on connect which want you to be identified before you are joining, add -autosendcmd "wait -xertion 2000" to your irssi network settings. This makes irssi wait 2 seconds before any further action, giving services time to identify you.

Command: /network add -autosendcmd "wait -xertion 2000" Xertion

ZNC

• Ensure the Cert module is loaded.
• Log in to your web admin panel, and go to the User Modules section and select "Certificate".
• Copy the contents of the .pem file you created into the edit box and apply the changes.
• Reconnect your ZNC to the IRC network.

When you connect to Xertion, you should see something like:

*** You are connected using SSL cipher "DHE-RSA-AES-256-CBC-SHA1" and your SSL fingerprint is xxxxxxxxxxxxxxxxxxxxxxx
* Welcome to the Xertion IRC Network Kaishiro

If you see that, that means you have configured everything correctly.

Add the certificate fingerprint to NickServ

First, identify yourself through services with /msg NickServ IDENTIFY password.

Next, just copy and paste this line /msg NickServ CERTFP ADD

Disable whatever auto-authentication you had with NickServ before you saw this tutorial and reconnect. If it worked you will be identified by services automatically via the fingerprint.

If you have any questions, feel free to join #help and ask.