adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Trusted fingerprints: public key fp vs certificate fp #822

New Issue
Open
opened 2026-10-05 04:46:34 +02:00 by adam · 3 comments
adam commented 2026-10-05 04:46:34 +02:00
Owner
Copy link
Copy source

Currently ZNC compares fingerprint of the whole certificate with the whitelist, not only the public key part. That breaks e.g. key pinning of freenode tor hidden service, which provides public key fingerprint; fp of the whole certificate changes every time letsencrypt cert is renewed.

openssl x509 -pubkey -noout < cert.crt shows the public key part of the certificate. Need to find out how to do it in C API.

Irssi seems to support this already.

Currently ZNC compares fingerprint of the whole certificate with the whitelist, not only the public key part. That breaks e.g. key pinning of [freenode tor hidden service](https://freenode.net/kb/answer/chat), which provides public key fingerprint; fp of the whole certificate changes every time letsencrypt cert is renewed. `openssl x509 -pubkey -noout < cert.crt` shows the public key part of the certificate. Need to find out how to do it in C API. Irssi seems to support this already. <!-- github-sync-id:310516087 -->
adam commented 2026-10-05 04:46:36 +02:00
Author
Owner
Copy link
Copy source

This will be really helpful for Freenode+Tor users like me. 👍

This will be really helpful for Freenode+Tor users like me. :+1: <!-- github-comment-id:377959221 -->
adam commented 2026-10-05 04:46:36 +02:00
Author
Owner
Copy link
Copy source

same here, would be really helpful

same here, would be really helpful <!-- github-comment-id:500549316 -->
adam commented 2026-10-05 04:46:37 +02:00
Author
Owner
Copy link
Copy source

The public key can also be gotten with gnutls-cli in case that is of any help for anyone.

└┌(%:~)┌- gnutls-cli chat.freenode.net:6697
...
        Public Key ID:
                sha1:f67d915f48fe77acb59231d32e7bb23db0430afd
                sha256:b575b498f1712f0042577568179b92fc4455ac198bdea6fae7fe3ed25046964e
...
The public key can also be gotten with `gnutls-cli` in case that is of any help for anyone. ``` └┌(%:~)┌- gnutls-cli chat.freenode.net:6697 ... Public Key ID: sha1:f67d915f48fe77acb59231d32e7bb23db0430afd sha256:b575b498f1712f0042577568179b92fc4455ac198bdea6fae7fe3ed25046964e ... ``` <!-- github-comment-id:501251052 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#822