Have ZNC-specific CA storage #489

New Issue

2026-10-05T04:24:43+02:00

adam commented

2026-10-05 04:24:43 +02:00

For adding certificate authorities for specific networks like OFTC or CACERT. This has been discussed on #znc multiple times.

http://www.oftc.net/
- We support SSL on all of our servers. The certificates are signed, indirectly, by SPI’s certification authority. You can get the root certificate at the SPI website under http://www.spi-inc.org/ca/spi-cacert.crt, and if you care you can verify it using the pgp-signed certificate fingerprints. Alternatively, install a certificate collection (ca-certificates or similar names are common) that includes it.
http://www.cacert.org/

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

For adding certificate authorities for specific networks like OFTC or CACERT. This has been discussed on #znc multiple times. - http://www.oftc.net/ - _We support SSL on all of our servers. The certificates are signed, indirectly, by SPI’s certification authority. You can get the root certificate at the SPI website under http://www.spi-inc.org/ca/spi-cacert.crt, and if you care you can verify it using the pgp-signed certificate fingerprints. Alternatively, install a certificate collection (ca-certificates or similar names are common) that includes it._ - http://www.cacert.org/ ## <bountysource-plugin> Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/9105870-have-znc-specific-ca-storage?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:24:44 +02:00

And was just requested again.

2015-05-07 12:10:18+0300 < Darac> Hello. Question about 1.6.0 and AddTrustedServerFingerprint. I want to connect to a network where the servers are signed by a network CA. Can I trust the fingerprint of that CA certificate and have ZNC trust the servers, or do I need to add the fingerprints of each servers' individual cert?
2015-05-07 12:17:37+0300 < Darac> (Actually, just tried that and it doesn't work)
2015-05-07 12:21:48+0300 < Darac> Ah, never mind. I see #909
2015-05-07 12:21:49+0300 < ZNC-Linker> https://github.com/znc/znc/issues/909 “Have ZNC-specific CA storage” (open)

And was just requested again. ``` 2015-05-07 12:10:18+0300 < Darac> Hello. Question about 1.6.0 and AddTrustedServerFingerprint. I want to connect to a network where the servers are signed by a network CA. Can I trust the fingerprint of that CA certificate and have ZNC trust the servers, or do I need to add the fingerprints of each servers' individual cert? 2015-05-07 12:17:37+0300 < Darac> (Actually, just tried that and it doesn't work) 2015-05-07 12:21:48+0300 < Darac> Ah, never mind. I see #909 2015-05-07 12:21:49+0300 < ZNC-Linker> https://github.com/znc/znc/issues/909 “Have ZNC-specific CA storage” (open) ```

adam commented

2026-10-05 04:24:44 +02:00

👍 this is sorely missing. :(

:+1: this is sorely missing. :(

adam commented

2026-10-05 04:24:45 +02:00

This is an important improvement, as there are irc networks who use a full-featured PKI, which one would trust for irc, but not system-wide. At the same time, if such network uses multiple servers in DNS rotation, adding all the fingerprints in not really an option.

This is an important improvement, as there are irc networks who use a full-featured PKI, which one would trust for irc, but not system-wide. At the same time, if such network uses multiple servers in DNS rotation, adding all the fingerprints in not really an option.

adam commented

2026-10-05 04:24:46 +02:00

Another network having it's own CA is Hackint.

https://www.hackint.org/ca

Another network having it's own CA is Hackint. - https://www.hackint.org/ca

adam commented

2026-10-05 04:24:46 +02:00

15:40 <user> hi all, i have a client specific problem with znc.. znc does not connect to hackint if i only specify the root-ca as trusted fingerprint and it will round-robin(?) all available servers without success
15:42 <user> so what is the best thing to do? 1.) import the root ca into my os trust store (not my favorit one) or 2.) specify all fingerprints of all hackint irc servers in my znc config?

Those are some fine questions.

``` 15:40 <user> hi all, i have a client specific problem with znc.. znc does not connect to hackint if i only specify the root-ca as trusted fingerprint and it will round-robin(?) all available servers without success 15:42 <user> so what is the best thing to do? 1.) import the root ca into my os trust store (not my favorit one) or 2.) specify all fingerprints of all hackint irc servers in my znc config? ``` Those are some fine questions.

adam commented

2026-10-05 04:24:47 +02:00

I would appreciate this being implemented, networks don't change CA often and would help to reduce attack surface for users from "any CA can validate" to "this specific CA can validate". In particular, I'm thinking about Tor users where the exit relays have the ability to MITM.

I would appreciate this being implemented, networks don't change CA often and would help to reduce attack surface for users from "any CA can validate" to "this specific CA can validate". In particular, I'm thinking about Tor users where the exit relays have the ability to MITM.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#489