As an alternative to password-based authentication, you can connect to freenode
with a TLS certificate and have services recognise it automatically.
+For SASL EXTERNAL to work, you must connect over SSL.
+
Creating a self-signed certificate
==================================
HexChat
-------
-The pem file should be placed in `certs/network name.pem` in the HexChat config
-directory (`~/.config/hexchat/` or `%appdata%\HexChat`), where `network name`
-is the name of the network as it appears in the network list (Ctrl-S). Note
+Place the .pem file in `certs/client.pem` in the HexChat config
+directory (`~/.config/hexchat/` or `%appdata%\HexChat`). Note
that the `certs` directory does not exist by default and you will have to
-create it yourself. Once the file is there, all subsequent SSL connections to
-that network will use the certificate.
+create it yourself. Once the file is there, all subsequent SSL connections
+will use the certificate.
+
+If you connect to multiple IRC networks, you should keep in mind that using the
+filename `certs/client.pem` will send the same certificate to all networks. If
+you prefer per-network certificates, use the name of the network exactly
+as it appears in the network list (Ctrl-S), including capitalisation and
+punctuation (e.g. `certs/freenode.pem` or `certs/Example Server.pem`).
Konversation
------------
-Create the pem file as per above, then place it wherever you want.
+Create the .pem file as per above, then place it wherever you want.
Start Konversation, then open the Identity dialogue by either pressing F8
or via the Settings menu entry. Choose the identity you use for the
freenode network or create a new one.