OCSP Must-Staple support #827

New Issue

2026-10-05T04:46:54+02:00

adam commented

2026-10-05 04:46:54 +02:00

Since Let's Encrypt allows to generate certificates with this feature, accessing to the ZNC web interface will fail in compliant browsers (e.g. Firefox with a MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING error).

This might also affect IRC clients in the future if they start going compliant with this feature which makes OCSP useful.

OS/distribution version: Fedora 27
/znc version: 1.6.6, IPv6: yes, SSL: yes, DNS: threads, charset: yes

Since Let's Encrypt allows to generate certificates with this feature, accessing to the ZNC web interface will fail in compliant browsers (e.g. Firefox with a `MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING` error). This might also affect IRC clients in the future if they start going compliant with this feature which makes OCSP useful. OS/distribution version: Fedora 27 `/znc version`: 1.6.6, IPv6: yes, SSL: yes, DNS: threads, charset: yes

adam commented

2026-10-05 04:46:55 +02:00

https://gist.github.com/sleevi/5efe9ef98961ecfb4da8 has more details how to
do this.

There are 2 parts - obtaining the staple, and sending it to client. ZNC
could read the staple from a file, and rely on some other software to
update it regularly.

2018-04-16 3:06 GMT+01:00 Francisco de la Peña notifications@github.com:

Since Let's Encrypt allows to generate certificates with this feature,
accessing to the ZNC web interface will fail in compliant browsers (e.g.
Firefox with a MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING error).

This might also affect IRC clients in the future if they start going
compliant with this feature which makes OCSP useful.

OS/distribution version: Fedora 27
/znc version: 1.6.6, IPv6: yes, SSL: yes, DNS: threads, charset: yes

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/znc/znc/issues/1516, or mute the thread
https://github.com/notifications/unsubscribe-auth/AAT15KLNxezzMNhxKA4K7O2kneTjI4ipks5to_ywgaJpZM4TVw6G
.

https://gist.github.com/sleevi/5efe9ef98961ecfb4da8 has more details how to do this. There are 2 parts - obtaining the staple, and sending it to client. ZNC could read the staple from a file, and rely on some other software to update it regularly. 2018-04-16 3:06 GMT+01:00 Francisco de la Peña <notifications@github.com>: > Since Let's Encrypt allows to generate certificates with this feature, > accessing to the ZNC web interface will fail in compliant browsers (e.g. > Firefox with a MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING error). > > This might also affect IRC clients in the future if they start going > compliant with this feature which makes OCSP useful. > > OS/distribution version: Fedora 27 > /znc version: 1.6.6, IPv6: yes, SSL: yes, DNS: threads, charset: yes > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <https://github.com/znc/znc/issues/1516>, or mute the thread > <https://github.com/notifications/unsubscribe-auth/AAT15KLNxezzMNhxKA4K7O2kneTjI4ipks5to_ywgaJpZM4TVw6G> > . >

adam commented

2026-10-05 04:46:56 +02:00

I know we're not fond of "me too" comments, but I've just now been bitten by this. Emacs ERC and Circe are both complaining that they can't properly verify the security.

ZNC is now the only software on my server that doesn't support OCSP.

I know we're not fond of "me too" comments, but I've just now been bitten by this. Emacs ERC and Circe are both complaining that they can't properly verify the security. ZNC is now the only software on my server that doesn't support OCSP.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#827