adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-10-31 01:32:02 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

ZNC doesn't handle subject alternative names of a let's encrypt certificate? #839

New Issue
Closed
opened 2026-10-05 04:47:54 +02:00 by adam · 7 comments
adam commented 2026-10-05 04:47:54 +02:00
Owner
Copy link
Copy source

ZNC Version: 1.8.x (self build from master branch)
OS: Debian 9.3

Hello I have the following problem:

If i want to connect to my znc server via hexchat I get the following error:

❨✽❩ Looking up chat.mydomain.example
❨✸❩ Connecting to dyndns.mydomain.example (xxx.xxx.xxx.xxx) port 6667...
* * Certification info:
*   Subject:
*     CN=chat.mydomain.example
*   Issuer:
*     C=US
*     O=Let's Encrypt
*     CN=Let's Encrypt Authority X3
*   Public key algorithm: rsaEncryption (4096 bits)
*   Sign algorithm sha256WithRSAEncryption
*   Valid since May 22 12:51:21 2018 GM to Aug 20 12:51:21 2018 GM
* * Cipher info:
*   Version: TLSv1/SSLv3, cipher ECDHE-RSA-AES128-GCM-SHA256 (128 bits)
❮✘❯ Connection failed. Error: unable to get local issuer certificate.? (20)

Also if I want to verify via openssl:

openssl s_client -connect chat.mydomain.example:6667
.
.
.
    Verify return code: 21 (unable to verify the first certificate)
    Extended master secret: yes
---

Port 443 is mapped to the same machine but will be answered by my nginx proxy with the same certificate znc uses:

openssl s_client -connect chat.mydomain.example:443
.
.
.
    Verify return code: 0 (ok)
    Extended master secret: yes
---

My setup has the following scenario:
I have a letsencrypt cert for my znc subdomain:
chat.mydomain.example which is a cname record on mydomain.example pointing to dyndns.mydomain.example. (I have to use this because I don't have a static IP at home and have to use dynamic DNS.)
dyndns.mydomain.example is mentioned inside my letsencrypt cert as alternative name.

I use the certificate inside the znc config like this (my znc user has read permission to the pem files):

SSLCertFile = /etc/letsencrypt/live/chat.mydomain.example/cert.pem
SSLDHParamFile = /etc/letsencrypt/live/chat.mydomain.example/chain.pem
SSLKeyFile = /etc/letsencrypt/live/chat.mydomain.example/privkey.pem

Does anyone know the source of my problem? Currently I have to tick the hexchat option to allow invalid certs which is kind of frustrating...

ZNC Version: 1.8.x (self build from master branch) OS: Debian 9.3 Hello I have the following problem: If i want to connect to my znc server via hexchat I get the following error: ``` ❨✽❩ Looking up chat.mydomain.example ❨✸❩ Connecting to dyndns.mydomain.example (xxx.xxx.xxx.xxx) port 6667... * * Certification info: * Subject: * CN=chat.mydomain.example * Issuer: * C=US * O=Let's Encrypt * CN=Let's Encrypt Authority X3 * Public key algorithm: rsaEncryption (4096 bits) * Sign algorithm sha256WithRSAEncryption * Valid since May 22 12:51:21 2018 GM to Aug 20 12:51:21 2018 GM * * Cipher info: * Version: TLSv1/SSLv3, cipher ECDHE-RSA-AES128-GCM-SHA256 (128 bits) ❮✘❯ Connection failed. Error: unable to get local issuer certificate.? (20) ``` Also if I want to verify via openssl: ``` openssl s_client -connect chat.mydomain.example:6667 . . . Verify return code: 21 (unable to verify the first certificate) Extended master secret: yes --- ``` Port 443 is mapped to the same machine but will be answered by my nginx proxy with the same certificate znc uses: ``` openssl s_client -connect chat.mydomain.example:443 . . . Verify return code: 0 (ok) Extended master secret: yes --- ``` My setup has the following scenario: I have a letsencrypt cert for my znc subdomain: chat.mydomain.example which is a cname record on mydomain.example pointing to dyndns.mydomain.example. (I have to use this because I don't have a static IP at home and have to use dynamic DNS.) dyndns.mydomain.example is mentioned inside my letsencrypt cert as alternative name. I use the certificate inside the znc config like this (my znc user has read permission to the pem files): ``` SSLCertFile = /etc/letsencrypt/live/chat.mydomain.example/cert.pem SSLDHParamFile = /etc/letsencrypt/live/chat.mydomain.example/chain.pem SSLKeyFile = /etc/letsencrypt/live/chat.mydomain.example/privkey.pem ``` Does anyone know the source of my problem? Currently I have to tick the hexchat option to allow invalid certs which is kind of frustrating... <!-- github-sync-id:325375761 -->
adam closed this issue 2026-10-05 04:47:54 +02:00
adam commented 2026-10-05 04:47:55 +02:00
Author
Owner
Copy link
Copy source

Addition:

Nginx response:

CONNECTED(00000003)
depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
verify return:1
depth=0 CN = chat.mydomain.example
verify return:1
---
Certificate chain
 0 s:/CN=chat.mydomain.example
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
   i:/O=Digital Signature Trust Co./CN=DST Root CA X3

ZNC response:

CONNECTED(00000003)
depth=0 CN = chat.mydomain.example
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = chat.mydomain.example
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/CN=chat.mydomain.example
   i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3

There is definitely something missing

Addition: Nginx response: ``` CONNECTED(00000003) depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=1 C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3 verify return:1 depth=0 CN = chat.mydomain.example verify return:1 --- Certificate chain 0 s:/CN=chat.mydomain.example i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 1 s:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 i:/O=Digital Signature Trust Co./CN=DST Root CA X3 ``` ZNC response: ``` CONNECTED(00000003) depth=0 CN = chat.mydomain.example verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN = chat.mydomain.example verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/CN=chat.mydomain.example i:/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3 ``` There is definitely something missing <!-- github-comment-id:391066663 -->
adam commented 2026-10-05 04:47:55 +02:00
Author
Owner
Copy link
Copy source

it sounds like the entire certificate chain isn't being served. Did you follow the documentation on the wiki for LetsEncrypt? This includes getting it so that ZNC serves the full certificate chain.

it sounds like the entire certificate chain isn't being served. Did you follow [the documentation on the wiki](https://wiki.znc.in/Signed_SSL_certificate#LetsEncrypt) for LetsEncrypt? This includes getting it so that ZNC serves the full certificate chain. <!-- github-comment-id:391067823 -->
adam commented 2026-10-05 04:47:56 +02:00
Author
Owner
Copy link
Copy source

I tried it now with the wiki/old way like you mentioned:
cat /etc/letsencrypt/live/example.org/{privkey,cert,chain}.pem > znc.pem

Works like a charm, so something bad is inside letting znc concat the cert, chain and private key...

I tried it now with the wiki/old way like you mentioned: cat /etc/letsencrypt/live/example.org/{privkey,cert,chain}.pem > znc.pem Works like a charm, so something bad is inside letting znc concat the cert, chain and private key... <!-- github-comment-id:391076485 -->
adam commented 2026-10-05 04:47:57 +02:00
Author
Owner
Copy link
Copy source

letting ZNC concat the cert, chain, and private key

How're you making this determination? Did you configure the various SSL options, or no?

> letting ZNC concat the cert, chain, and private key How're you making this determination? Did you configure the various SSL options, or no? <!-- github-comment-id:391077363 -->
adam commented 2026-10-05 04:47:57 +02:00
Author
Owner
Copy link
Copy source

All shame on me -.- I only had to use the fullchain.pem instead of only the cert... I misinterpreted SSLDHParamFile...

SSLCertFile = /etc/letsencrypt/live/chat.mydomain.example/fullchain.pem
SSLKeyFile = /etc/letsencrypt/live/chat.mydomain.example/privkey.pem

Issue is closed because of my own stupidy...

All shame on me -.- I only had to use the fullchain.pem instead of only the cert... I misinterpreted SSLDHParamFile... ``` SSLCertFile = /etc/letsencrypt/live/chat.mydomain.example/fullchain.pem SSLKeyFile = /etc/letsencrypt/live/chat.mydomain.example/privkey.pem ``` Issue is closed because of my own stupidy... <!-- github-comment-id:391083381 -->
adam commented 2026-10-05 04:47:58 +02:00
Author
Owner
Copy link
Copy source

@bin101 So what do you put for SSLDHParamFile with Let's Encrypt? Just leave it blank? The Wiki instructions for Let's Encrypt are outdated and only mention the pre-v.1.7 way to do it when the SSLDHParamFile parameter didn't exist.

@bin101 So what do you put for SSLDHParamFile with Let's Encrypt? Just leave it blank? The Wiki instructions for Let's Encrypt are outdated and only mention the pre-v.1.7 way to do it when the SSLDHParamFile parameter didn't exist. <!-- github-comment-id:520183574 -->
adam commented 2026-10-05 04:47:59 +02:00
Author
Owner
Copy link
Copy source

@melikyuksel Generate DH params by running openssl dhparam 2048 > dh.pem (filename can be whatever you want) and point SSLDHParamFile to it. Please feel free to improve the wiki.

@melikyuksel Generate DH params by running `openssl dhparam 2048 > dh.pem` (filename can be whatever you want) and point `SSLDHParamFile` to it. Please feel free to improve the wiki. <!-- github-comment-id:520262697 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#839