6 As an alternative to password-based authentication, you can connect to freenode
7 with a TLS certificate and have services recognise it automatically.
9 For SASL EXTERNAL to work, you must connect over SSL.
11 Creating a self-signed certificate
12 ==================================
14 In order to follow these instructions, you will need the
`openssl` utility. If
15 you are using Windows and do not have a copy, you might consider using Cygwin.
17 You can generate a certificate with the following command:
19 openssl req -x509 -new -newkey rsa:
4096 -sha256 -days
1000 -nodes -out freenode.pem -keyout freenode.pem
21 You will be prompted for various pieces of information about the certificate.
22 The contents do not matter for our purposes, but
`openssl` needs at least one of
25 The
`.pem` file will have the same access to your NickServ account as your
26 password does, so take appropriate care in securing it.
28 Under Unix-like environments, the following command:
30 openssl x509 -in freenode.pem -outform der | sha1sum -b | cut -d' ' -f1
32 will list the certificate fingerprint.
35 Connecting to freenode with your certificate
36 ============================================
38 IRC clients generally differ in where they look for a certificate and how you
39 configure them to offer it to the server. If yours is not yet listed here,
40 advice in this section is unlikely to apply, but guides may be available
46 Move the certificates you created above to ~/.irssi/certs
49 mv freenode.pem ~/.irssi/certs
51 Now configure your
`/server` entry for freenode to use this certificate. You
52 may need to adapt this example for your existing configuration (the network
53 and hostname should match what you already use).
55 /server add -auto -ssl -ssl_cert ~/.irssi/certs/freenode.pem -network freenode chat.freenode.net
6697
60 Move the certificates you created above to ~/.weechat/certs
62 mkdir ~/.weechat/certs
63 mv freenode.pem ~/.weechat/certs
65 Now disconnect and remove the current freenode server(s). Re-add it with the
66 SSL flag, using your newly generated certificate. Note that these commands are
67 just examples, you have to adapt them to your current servers.
69 /set irc.server.freenode.addresses chat.freenode.net/
6697
70 /set irc.server.freenode.ssl on
71 /set irc.server.freenode.ssl_verify on
72 /set irc.server.freenode.ssl_cert %h/certs/freenode.pem
73 /set irc.server.freenode.sasl_mechanism external
75 and then reconnect to freenode.
80 Refer to znc's
[official documentation](http://wiki.znc.in/Cert).
85 The pem file should be placed in
`certs/network name.pem` in the HexChat config
86 directory (
`~/.config/hexchat/` or
`%appdata%\HexChat`), where
`network name`
87 is the name of the network as it appears in the network list (Ctrl-S). Note
88 that the
`certs` directory does not exist by default and you will have to
89 create it yourself. Once the file is there, all subsequent SSL connections to
90 that network will use the certificate.
95 Create the pem file as per above, then place it wherever you want.
96 Start Konversation, then open the Identity dialogue by either pressing F8
97 or via the Settings menu entry. Choose the identity you use for the
98 freenode network or create a new one.
99 In the part
`Auto Identity` you have to choose
`SASL External (Cert)`
100 as the
`Type` for SASL External or
`SSL CLient Certificate` for CertFP.
101 SASL External requires at least version
1.7 of Konversation.
102 Optionally fill in your account name in the
`Account`field.
103 You can then choose the certificate you created with the file picker
104 or enter the path manually in the field next to it.
105 Once done, apply the configuration and (re)connect to freenode.
107 Add your fingerprint to NickServ
108 ================================
110 You can then check whether you have a fingerprint by using
`whois` on yourself:
114 YourOwnNick has client certificate fingerprint f3a1aad46ca88e180c25c9c7021a4b3a
117 To allow NickServ to recognise you based on your certificate, you need to add
118 the fingerprint to your account (you will need to log in by other means in order
121 You can then authorise your current certificate fingerprint:
123 /msg NickServ CERT ADD
125 In the future, any connections you make to freenode with your certificate will
126 be logged into your account automatically. Optionally, or if you wish to connect
127 via Tor, you can enable SASL with the
`EXTERNAL` mechanism.