certauth for web interface? #316

New Issue

2026-10-05T04:12:45+02:00

adam commented

2026-10-05 04:12:45 +02:00

Feature request:

When I go to my ZNC web interface, Chrome shows a list of various client certificates. The one I use with the certauth module is listed, but using it does not log me in.

Alternatively, it shouldn't try to use client certificates for the web interface (it must be an OpenSSL option?)

Running ZNC 1.1-git-165-8c6b4b8

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/1504273-certauth-for-web-interface?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

Feature request: When I go to my ZNC web interface, Chrome shows a list of various client certificates. The one I use with the certauth module is listed, but using it does not log me in. Alternatively, it shouldn't try to use client certificates for the web interface (it must be an OpenSSL option?) Running ZNC 1.1-git-165-8c6b4b8 ## <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/1504273-certauth-for-web-interface?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:12:46 +02:00

Apparently this does in fact work (as pointed on IRC), any password will be accepted when logging in. Not entirely clear however.

I guess it needs to know the user name, but, perhaps looking through every user's certauth signatures would be a way to do it?

Apparently this does in fact work (as pointed on IRC), any password will be accepted when logging in. Not entirely clear however. I guess it needs to know the user name, but, perhaps looking through every user's certauth signatures would be a way to do it?

adam commented

2026-10-05 04:12:47 +02:00

certauth works for the web interface and certauth works for IRC. However, in both cases it requires the user to enter SOME password (even an empty password will do). This isn't a speciality of the web interface.

The reason for this is that it needs ZNC's internal "is this password OK?"-machinery to run and the right module calls to be executed. Only then is certauth called and can say that this login is OK.

So this is a restriction of the ZNC module API which likely can't be fixed without breaking some API. And I guess the resulting API would special case on sockets so that logins can "magically happen". Not really the nice'st API.... (And I'd prefer if the user name wouldn't automagically be deduced, but ok...)

certauth works for the web interface and certauth works for IRC. However, in both cases it requires the user to enter SOME password (even an empty password will do). This isn't a speciality of the web interface. The reason for this is that it needs ZNC's internal "is this password OK?"-machinery to run and the right module calls to be executed. Only then is certauth called and can say that this login is OK. So this is a restriction of the ZNC module API which likely can't be fixed without breaking some API. And I guess the resulting API would special case on sockets so that logins can "magically happen". Not really the nice'st API.... (And I'd prefer if the user name wouldn't automagically be deduced, but ok...)

adam commented

2026-10-05 04:12:47 +02:00

Username doesn't need to be deduced automagically... Client certificate
contains it (CN=johndoe)

2014-04-07 14:07 GMT+01:00 Uli Schlachter notifications@github.com:

certauth works for the web interface and certauth works for IRC. However,
in both cases it requires the user to enter SOME password (even an empty
password will do). This isn't a speciality of the web interface.

The reason for this is that it needs ZNC's internal "is this password
OK?"-machinery to run and the right module calls to be executed. Only then
is certauth called and can say that this login is OK.

So this is a restriction of the ZNC module API which likely can't be fixed
without breaking some API. And I guess the resulting API would special case
on sockets so that logins can "magically happen". Not really the nice'st
API.... (And I'd prefer if the user name wouldn't automagically be deduced,
but ok...)

—
Reply to this email directly or view it on GitHubhttps://github.com/znc/znc/issues/522#issuecomment-39727078
.

Username doesn't need to be deduced automagically... Client certificate contains it (CN=johndoe) 2014-04-07 14:07 GMT+01:00 Uli Schlachter notifications@github.com: > certauth works for the web interface and certauth works for IRC. However, > in both cases it requires the user to enter SOME password (even an empty > password will do). This isn't a speciality of the web interface. > > The reason for this is that it needs ZNC's internal "is this password > OK?"-machinery to run and the right module calls to be executed. Only then > is certauth called and can say that this login is OK. > > So this is a restriction of the ZNC module API which likely can't be fixed > without breaking some API. And I guess the resulting API would special case > on sockets so that logins can "magically happen". Not really the nice'st > API.... (And I'd prefer if the user name wouldn't automagically be deduced, > but ok...) > > — > Reply to this email directly or view it on GitHubhttps://github.com/znc/znc/issues/522#issuecomment-39727078 > .

adam commented

2026-10-05 04:12:48 +02:00

I don't understand this issue, but when I give webadmin my username and leave password as empty certauth logs me in. Shouldn't this be closed?

I don't understand this issue, but when I give webadmin my username and leave password as empty certauth logs me in. Shouldn't this be closed?

adam referenced this issue

2026-10-05 04:15:45 +02:00

Add support for cap account-tag #366

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#316