adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 02:42:21 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

What to do with IRC servers using Let's Encrypt certificates? #814

New Issue
Closed
opened 2026-10-05 04:46:04 +02:00 by adam · 21 comments
adam commented 2026-10-05 04:46:04 +02:00
Owner
Copy link
Copy source

I have several IRC servers I connect to that are currently using Let's Encrypt certificates, and I guess because they're not sending the entire trust chain with their connection requests, I get untrusted certificate notices every 2 months as they replace their certificates with new ones a month or so before the old ones expire. I end up having to add a new fingerprint every two months or so.

Is there something I can tell these server administrators about configuring their services properly with Let's Encrypt? Or is this a ZNC bug?

I have several IRC servers I connect to that are currently using Let's Encrypt certificates, and I guess because they're not sending the entire trust chain with their connection requests, I get untrusted certificate notices every 2 months as they replace their certificates with new ones a month or so before the old ones expire. I end up having to add a new fingerprint every two months or so. Is there something I can tell these server administrators about configuring their services properly with Let's Encrypt? Or is this a ZNC bug? <!-- github-sync-id:295386833 -->
adam closed this issue 2026-10-05 04:46:04 +02:00
adam commented 2026-10-05 04:46:05 +02:00
Author
Owner
Copy link
Copy source

and I guess because they're not sending the entire trust chain with their connection requests

You can verify that hypothesis using openssl s_client:

$ openssl s_client -showcerts -connect irc.badssl.com:6667 < /dev/null
> and I guess because they're not sending the entire trust chain with their connection requests You can verify that hypothesis using `openssl s_client`: ``` $ openssl s_client -showcerts -connect irc.badssl.com:6667 < /dev/null ``` <!-- github-comment-id:364004879 -->
adam commented 2026-10-05 04:46:06 +02:00
Author
Owner
Copy link
Copy source

FWIW, the latest certbot version generates the following files and descriptions:

`fullchain.pem`: the certificate file used in most server software.
`cert.pem`     : will break many server configurations, and should not be used
                 without reading further documentation (see link below).

So not using fullchain.pem is probably a mis-configuration that ought to be fixed server-side.

You could probably work around it locally by importing the Let's Encrypt intermediary certificate to your trusted root certificates store.

(The above is not an authoritative answer; I might be completely wrong.)

FWIW, the latest `certbot` version generates the following files and descriptions: ``` `fullchain.pem`: the certificate file used in most server software. `cert.pem` : will break many server configurations, and should not be used without reading further documentation (see link below). ``` So not using `fullchain.pem` is probably a mis-configuration that ought to be fixed server-side. You could probably work around it locally by importing the Let's Encrypt intermediary certificate to your trusted root certificates store. (The above is not an authoritative answer; I might be completely wrong.) <!-- github-comment-id:364005554 -->
adam commented 2026-10-05 04:46:07 +02:00
Author
Owner
Copy link
Copy source

@CyberShadow I dont think thats whats being asked or addressed here.

@kode54 Theres no way around that in the existing infrastructure - new cert, new fingerprint. Not really a bug, either, really, though, I dont think.

@CyberShadow I dont think thats whats being asked or addressed here. @kode54 Theres no way around that in the existing infrastructure - new cert, new fingerprint. Not really a bug, either, really, though, I dont think. <!-- github-comment-id:364005949 -->
adam commented 2026-10-05 04:46:07 +02:00
Author
Owner
Copy link
Copy source

@kode54 Do you use "Trust the PKI", or do you use certificate fingerprint whitelisting only?

If you enabled PKI verification, then see my posts above. Otherwise see @teward's answer.

@kode54 Do you use "Trust the PKI", or do you use certificate fingerprint whitelisting only? If you enabled PKI verification, then see my posts above. Otherwise see @teward's answer. <!-- github-comment-id:364006452 -->
adam commented 2026-10-05 04:46:08 +02:00
Author
Owner
Copy link
Copy source

Do you have ca-certificates package installed? (its name can be different depending on your OS)

Do you have ca-certificates package installed? (its name can be different depending on your OS) <!-- github-comment-id:364060398 -->
adam commented 2026-10-05 04:46:09 +02:00
Author
Owner
Copy link
Copy source

@teward only if certificate is self-signed. In let's encrypt case, there is a common root cert, so manually approving every new cert is not needed.

@teward only if certificate is self-signed. In let's encrypt case, there is a common root cert, so manually approving every new cert is not needed. <!-- github-comment-id:364060851 -->
adam commented 2026-10-05 04:46:09 +02:00
Author
Owner
Copy link
Copy source

The servers are not sending the full chain, only the tip certificate. And I am only using certificate fingerprint whitelisting, not trusting an entire PKI. I'm not sure how to go about that, on an Ubuntu 16.04 LTS server.

The servers are not sending the full chain, only the tip certificate. And I am only using certificate fingerprint whitelisting, not trusting an entire PKI. I'm not sure how to go about that, on an Ubuntu 16.04 LTS server. <!-- github-comment-id:364402994 -->
adam commented 2026-10-05 04:46:10 +02:00
Author
Owner
Copy link
Copy source

What ZNC version? PKI and therefore Let's encrypt are trusted by default, provided ca-certificates package is installed.

What ZNC version? PKI and therefore Let's encrypt are trusted by default, provided ca-certificates package is installed. <!-- github-comment-id:364422367 -->
adam commented 2026-10-05 04:46:11 +02:00
Author
Owner
Copy link
Copy source

ZNC is:

ZNC 1.6.3+deb1 - http://znc.in
IPv6: yes, SSL: yes, DNS: threads, charset: yes

ca-certificates is installed. Connecting to these servers without the fingerprint added results in:

21:01 <*status> Disconnected from IRC (Invalid SSL certificate: unable to get local issuer certificate, unable to verify the first certificate). Reconnecting...
ZNC is: ``` ZNC 1.6.3+deb1 - http://znc.in IPv6: yes, SSL: yes, DNS: threads, charset: yes ``` ca-certificates is installed. Connecting to these servers without the fingerprint added results in: ``` 21:01 <*status> Disconnected from IRC (Invalid SSL certificate: unable to get local issuer certificate, unable to verify the first certificate). Reconnecting... ``` <!-- github-comment-id:364596909 -->
adam commented 2026-10-05 04:46:11 +02:00
Author
Owner
Copy link
Copy source

Can you share name of server?

Can you share name of server? <!-- github-comment-id:364597613 -->
adam commented 2026-10-05 04:46:12 +02:00
Author
Owner
Copy link
Copy source

irc.kitsunet.net port 6697 for TLS.

irc.kitsunet.net port 6697 for TLS. <!-- github-comment-id:364599693 -->
adam commented 2026-10-05 04:46:13 +02:00
Author
Owner
Copy link
Copy source

The servers are not sending the full chain, only the tip certificate.

Yep.
If server is misconfigured, we can't do much about it. Ask him to send correct certificate.

> The servers are not sending the full chain, only the tip certificate. Yep. If server is misconfigured, we can't do much about it. Ask him to send correct certificate. <!-- github-comment-id:364600786 -->
adam commented 2026-10-05 04:46:13 +02:00
Author
Owner
Copy link
Copy source

I have a similar issue with irc.rizon.net:6697 but it seems to return the chain, so not sure if this is actually the same issue, although they are using Let's Encrypt too.

I suspect in this case it is because of server round-robin. Any idea how to deal with that case?

I have a similar issue with `irc.rizon.net:6697` but it seems to return the chain, so not sure if this is actually the same issue, although they are using Let's Encrypt too. I suspect in this case it is because of server round-robin. Any idea how to deal with that case? <!-- github-comment-id:366512714 -->
adam commented 2026-10-05 04:46:14 +02:00
Author
Owner
Copy link
Copy source

@leak what is the exact error you're getting?

@leak what is the exact error you're getting? <!-- github-comment-id:366514693 -->
adam commented 2026-10-05 04:46:15 +02:00
Author
Owner
Copy link
Copy source

It is not an error, but rather the prompt If you trust this certificate, do /znc AddTrustedServerFingerprint..... every time I restart znc (either because znc or depending libraries updated)

It is not an error, but rather the prompt `If you trust this certificate, do /znc AddTrustedServerFingerprint.....` every time I restart znc (either because znc or depending libraries updated) <!-- github-comment-id:366514832 -->
adam commented 2026-10-05 04:46:15 +02:00
Author
Owner
Copy link
Copy source

No, there is an error, it's above this prompt. Right before details of the certificate.

No, there is an error, it's above this prompt. Right before details of the certificate. <!-- github-comment-id:366514915 -->
adam commented 2026-10-05 04:46:16 +02:00
Author
Owner
Copy link
Copy source

[14:09:18] <*status> Disconnected from IRC (Invalid SSL certificate: hostname doesn't match). Reconnecting...

Looks like it is a round-robin issue. Would be interesting to know how to deal with that though, quite a few IRC-servers do that.

`[14:09:18] <*status> Disconnected from IRC (Invalid SSL certificate: hostname doesn't match). Reconnecting...` Looks like it is a round-robin issue. Would be interesting to know how to deal with that though, quite a few IRC-servers do that. <!-- github-comment-id:366515055 -->
adam commented 2026-10-05 04:46:17 +02:00
Author
Owner
Copy link
Copy source

Show the certificate details you're getting, and output of /znc listservers

Show the certificate details you're getting, and output of `/znc listservers` <!-- github-comment-id:366515113 -->
adam commented 2026-10-05 04:46:17 +02:00
Author
Owner
Copy link
Copy source

https://gist.github.com/leak/7cdb4202061ccefe50f2ab99dd8f851e

listservers at the end

https://gist.github.com/leak/7cdb4202061ccefe50f2ab99dd8f851e listservers at the end <!-- github-comment-id:366515314 -->
adam commented 2026-10-05 04:46:18 +02:00
Author
Owner
Copy link
Copy source

Well, this certificate is for irc.rizon.net, but you're connecting to irc6.rizon.net. They are different domains. Connect to irc.rizon.net instead.

Well, this certificate is for irc.rizon.net, but you're connecting to irc6.rizon.net. They are different domains. Connect to irc.rizon.net instead. <!-- github-comment-id:366515436 -->
adam commented 2026-10-05 04:46:19 +02:00
Author
Owner
Copy link
Copy source

That's a good point, will try that - Thank you.

That's a good point, will try that - Thank you. <!-- github-comment-id:366515769 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#814