Need the ability to specify able to specify different certificates for different listeners #438

New Issue

2026-10-05T04:20:56+02:00

adam commented

2026-10-05 04:20:56 +02:00

This reason is because people use different web address to access znc, one for the web admin and one for a irc client to connect to, plus znc is designed to service more then one user, and so one should be able to give different users different addresses or ports , and of course give them their own ssl file.

In short this needs fixed for convenience and security sake.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

This reason is because people use different web address to access znc, one for the web admin and one for a irc client to connect to, plus znc is designed to service more then one user, and so one should be able to give different users different addresses or ports , and of course give them their own ssl file. In short this needs fixed for convenience and security sake. ## <bountysource-plugin> Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/7201152-need-the-ability-to-specify-able-to-specify-different-certificates-for-different-listeners?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:20:57 +02:00

znc is designed to service more then one user, and so one should be able to give different users different addresses

Interesting logic. May you explain?

and of course give them their own ssl file

Why?

In short this needs fixed for convenience and security sake.

How exactly it increases security?

> znc is designed to service more then one user, and so one should be able to give different users different addresses Interesting logic. May you explain? > and of course give them their own ssl file Why? > In short this needs fixed for convenience and security sake. How exactly it increases security?

adam commented

2026-10-05 04:20:57 +02:00

It increases security because you can optionally require the ssl file to have a password phrase, unique to each user.

It increases security because you can optionally require the ssl file to have a password phrase, unique to each user.

adam commented

2026-10-05 04:20:58 +02:00

require the ssl file to have a password phrase, unique to each user.

And how this increases security?

Password-protected certificates are not supported currently, but even if they were, only ZNC administrator needs to know the password, and to type it on ZNC startup.
So administrator will need to type multiple certificate passwords, one per user? [sarcasm]Sounds very convenient.[/sarcasm]

If you're speaking about authenticating users via certificates, nothing stops certauth to work with a single server-side certificate.

> require the ssl file to have a password phrase, unique to each user. And how this increases security? Password-protected certificates are not supported currently, but even if they were, only ZNC administrator needs to know the password, and to type it on ZNC startup. So administrator will need to type multiple certificate passwords, one per user? [sarcasm]Sounds very convenient.[/sarcasm] If you're speaking about authenticating users via certificates, nothing stops [certauth](http://wiki.znc.in/certauth) to work with a single server-side certificate.

adam commented

2026-10-05 04:20:59 +02:00

It looks like nothing has happened with this issue either, so closing?

It looks like nothing has happened with this issue either, so closing?

adam commented

2026-10-05 04:20:59 +02:00

This would be quite useful to me, it would allow me to use a VPN port with its own TLS certificate.

To elaborate:
My ISP (in fact, most of the German DSL ISPs) disconnect the PPPoE session every 24 hours.
Using a VPN to connect to the ZNC host would permit me to skip the daily "lost connection, reconnecting to server" cycle in my weechat setup.
On ZNC, I'd have a znchost.example.com and znchost.vpn, so I could connect to znchost.vpn using a self-signed cert from weechat while trusting the TLS fingerprint, and to znchost.example.com using a Lets Encrypt certificate.

This would be quite useful to me, it would allow me to use a VPN port with its own TLS certificate. To elaborate: My ISP (in fact, most of the German DSL ISPs) disconnect the PPPoE session every 24 hours. Using a VPN to connect to the ZNC host would permit me to skip the daily "lost connection, reconnecting to server" cycle in my weechat setup. On ZNC, I'd have a znchost.example.com and znchost.vpn, so I could connect to znchost.vpn using a self-signed cert from weechat while trusting the TLS fingerprint, and to znchost.example.com using a Lets Encrypt certificate.

adam commented

2026-10-05 04:21:00 +02:00

In short this needs fixed for convenience and security sake.

How exactly it increases security?

It would allow having IRC and WebUI on separate IPs without the certificate exposing the hostname for the other. I'm currently accomplishing this by having web listen on ::1 and using a reverse proxy.

> > In short this needs fixed for convenience and security sake. > > How exactly it increases security? It would allow having IRC and WebUI on separate IPs without the certificate exposing the hostname for the other. I'm currently accomplishing this by having web listen on ::1 and using a reverse proxy.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#438