Fix fs commands to only use the .pem file

[irc/freenode/web-7.0.git] / content / kb / using / nickcerts.md

Title: NickServ and certificates
Slug: certfp
---

You can add a certificate fingerprint to your NickServ account in order to identify via CertFP or via SASL external. 
In order to do so, you need an IRC client which supports SSL with a client certificate. 

Creating a self-signed certificate
==================================

First you need generate a self-signed certificate. We will be using OpenSSL which should be available for most unix-like operating systems and also via ports to other platforms, such as Microsoft Windows.

To generate a certificate and key, the `openssl` command can be used with the 'req' option.

    openssl req -x509 -new -newkey rsa:4096 -sha256 -days 1000 -out freenode.pem -keyout freenode.pem

Fill out the fields as you wish, it does not matter whether you put in correct address information or not.

Note that the resulting file should be placed on secure storage, with correct permissions 
(e.g. `chmod 400` for on unix like systems) and not given to third parties. 
You can also protect your key with a password if your client can handle that.

If you want to already perform the steps on adding the information to your NickServ account, 
which are described at the end of this article, you need to get the fingerprint. The command

    openssl x509 -in .irssi/certs/freenode.pem -outform der | sha1sum | cut -d' ' -f1

will list the fingerprint so you can write it down or copy it.


Connecting to freenode with your certificate
============================================

How you have to add the certificate depends on your client. 
If the one you are using is not listed here yet, please consult your client's documentation.
Documentation for various clients is also available on the website of our friends at 
[OFTC<i class="fa fa-external-link" aria-hidden="true"></i>](https://www.oftc.net/NickServ/CertFP/),
most of it can be adopted to freenode by just changing the server address.
We are also open to pull requests to add new clients. 

irssi
-----

Move the certificates you created above to ~/.irssi/certs

    mkdir ~/.irssi/certs
    mv nick.pem ~/.irssi/certs

Now remove the current freenode server(s) and re-add it with the SSL flag,
using your newly generated certificate. Note that these commands are just examples, 
you have to adapt them to your current networks and servers.

    /server remove chat.freenode.net
    /network add freenode
    /server add -auto -ssl -ssl_cert ~/.irssi/certs/nick.pem -ssl_verify -network freenode chat.freenode.net 6697

Also if you plan to use Tor and add the hidden service instead, -ssl_verify has to be omitted as the certificate
won't match the hidden service.

weechat
-------

Move the certificates you created above to ~/.weechat/certs

    mkdir ~/.weechat/certs  
    mv nick.pem ~/.weechat/certs

Now disconnect and remove the current freenode server(s).
Re-add it with the SSL flag, using your newly generated certificate.
Note that these commands are just examples, 
you have to adapt them to your current servers.

    /disconnect freenode
    /server del freenode
    /server add freenode chat.freenode.net/6697 -ssl -ssl_verify -autoconnect
    /set irc.server.freenode.ssl_cert %h/certs/nick.pem

and then reconnect to freenode.

znc
---

znc provides an official documentation in 
[their wiki<i class="fa fa-external-link" aria-hidden="true"></i>](http://en.znc.in/wiki/Cert)


Add your fingerprint to NickServ
================================

If you added the certificate to your client you can now connect to freenode.
You can then check whether you have a fingerprint by using `whois` on yourself: 

    /whois YourOwnNick
    ...
    YourOwnNick has client certificate fingerprint f3a1aad46ca88e180c25c9c7021a4b3a
    ...

This means that your certificate is working.

To allow NickServ to identify you based on this certificate, you need to add the fingerprint to your account.
If you are not identified with NickServ, then do so now. See `/msg nickserv help identify` if needed. 

Afterwards you can add the fingerprint with the `CERT ADD` command. 
If you are connected using the certificate and the correct fingerprint shows in `whois`, you can just issue

    /msg NickServ CERT ADD
    
Otherwise you have to specify the fingerprint as parameter

    /msg NickServ CERT ADD f3a1aad46ca88e180c25c9c7021a4b3a

Nickserv will message back saying that the fingerprint was added. 
You can now use it to identify via CertFP or SASL EXTERNAL.
Please refer to your client documentation on how to do so.