adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 10:52:22 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

Enhancement: Strip spaces for SSL variables #990

New Issue
Open
opened 2026-10-05 04:57:15 +02:00 by adam · 2 comments
adam commented 2026-10-05 04:57:15 +02:00
Owner
Copy link
Copy source

OS: Ubuntu 20.04 LTS
ZNC: Tested with 1.8.5 (ubuntu repositories) and build from 29142359cd

ZNC works fine on the port without ssl, I can use both the webadmin interface and irc from multiple IRC clients. I am trying to get it working with ssl certificates from let's encrypt that I already use on my site. I have the certs in a folder that my user can read (doing the cat command on any of the files work). I have this in my znc config:

anoniplimit = 10
authonlyviamodule = false
configwritedelay = 0
connectdelay = 5
hideversion = false
loadmodule = webadmin
loadmodule = adminlog
maxbuffersize = 500
protectwebsessions = true
sslcertfile = /certs/mattf/fullchain.pem
ssldhparamfile = /certs/mattf/ssl-dhparams.pem
sslkeyfile = /certs/mattf/privkey.pem 
serverthrottle = 30
skin = _default_
statusprefix = *
version = 1.9.x

<Listener listener0>
	AllowIRC = true
	AllowWeb = true
	IPv4 = true
	IPv6 = true
	Port = 6668
	SSL = false
	URIPrefix = /
</Listener>

<Listener listener1>
	AllowIRC = true
	AllowWeb = true
	IPv4 = true
	IPv6 = true
	Port = 6669
	SSL = true
	URIPrefix = /
</Listener>

<Listener listener2>
	AllowIRC = true
	AllowWeb = true
	IPv4 = true
	IPv6 = true
	Port = 6697
	SSL = true
	URIPrefix = /
</Listener>

<Listener listener3>
	AllowIRC = true
	AllowWeb = true
	IPv4 = true
	IPv6 = true
	Port = 6643
	SSL = true
	URIPrefix = /
</Listener>

None of the SSL ports work. If i try from the browser this is what I get: . PR_END_OF_FILE_ERROR

image

Also the IRC clients cannot connect. In both cases this is what gets logged (with irc or webadmin https):

znc -f -D

...

[2021-07-09 20:37:41.840726] _LISTENER == ConnectionFrom(******) [Allowed]                                         │
[2021-07-09 20:37:41.840800] There are [0] clients from [******]                                                          │
[2021-07-09 20:37:41.840956] /home/mattf/znc/src/Csocket.cpp:1851 Bad keyfile ... [/certs/mattf/privkey.pem ]                 │

Still the key seems to be ok:

$ openssl rsa -check -noout -in privkey.pem                                                                                   
RSA key ok          

# mattf @ mattf in /certs/mattf [20:42:44] C:130                                                                              
$ openssl x509 -modulus -noout -in fullchain.pem | openssl md5      
                                                          
(stdin)= f38d5606c23b48a3e962718406c48fe7                                                                                     
                                                                                                                              
# mattf @ mattf in /certs/mattf [20:42:56]                                                                                    
$ openssl rsa -modulus -noout -in privkey.pem | openssl md5                                                                   
(stdin)= f38d5606c23b48a3e962718406c48fe7  

# mattf @ mattf in /certs/mattf [20:45:24]                                                                                    
$ ls -Slah /certs/mattf                                                                                                      
total 32K                                                                                                                    
-rw-r--r-- 1 root root 7.2K Jul  9 21:00 znc.pem                                                                              
-rw-r--r-- 1 root sudo 5.5K Jul  9 21:00 fullchain.pem                                                                        
drwxr-xr-x 2 root sudo 4.0K Jul  9 20:28 .                                                                                    
drwxr-xr-x 3 root sudo 4.0K Jul  9 07:10 ..                                                                                   
-rw-r--r-- 1 root sudo 1.7K Jul  9 21:00 privkey.pem                                                                          
-rw-r--r-- 1 root sudo  424 Jul  9 21:00 ssl-dhparams.pem      

$ openssl version                                                                                                             │
OpenSSL 1.1.1f  31 Mar 2020                                                                                                   │

And the same key and cert are working on my nginx server.

OS: Ubuntu 20.04 LTS ZNC: Tested with 1.8.5 (ubuntu repositories) and build from 29142359cd8b2c2bd805776ce70ddc3bec8d2abe ZNC works fine on the port without ssl, I can use both the webadmin interface and irc from multiple IRC clients. I am trying to get it working with ssl certificates from let's encrypt that I already use on my site. I have the certs in a folder that my user can read (doing the cat command on any of the files work). I have this in my znc config: ```bash anoniplimit = 10 authonlyviamodule = false configwritedelay = 0 connectdelay = 5 hideversion = false loadmodule = webadmin loadmodule = adminlog maxbuffersize = 500 protectwebsessions = true sslcertfile = /certs/mattf/fullchain.pem ssldhparamfile = /certs/mattf/ssl-dhparams.pem sslkeyfile = /certs/mattf/privkey.pem serverthrottle = 30 skin = _default_ statusprefix = * version = 1.9.x <Listener listener0> AllowIRC = true AllowWeb = true IPv4 = true IPv6 = true Port = 6668 SSL = false URIPrefix = / </Listener> <Listener listener1> AllowIRC = true AllowWeb = true IPv4 = true IPv6 = true Port = 6669 SSL = true URIPrefix = / </Listener> <Listener listener2> AllowIRC = true AllowWeb = true IPv4 = true IPv6 = true Port = 6697 SSL = true URIPrefix = / </Listener> <Listener listener3> AllowIRC = true AllowWeb = true IPv4 = true IPv6 = true Port = 6643 SSL = true URIPrefix = / </Listener> ``` None of the SSL ports work. If i try from the browser this is what I get: . PR_END_OF_FILE_ERROR ![image](https://user-images.githubusercontent.com/24435787/125133349-2437dd80-e0dc-11eb-8960-184e4981f14f.png) Also the IRC clients cannot connect. In both cases this is what gets logged (with irc or webadmin https): ```bash znc -f -D ... [2021-07-09 20:37:41.840726] _LISTENER == ConnectionFrom(******) [Allowed] │ [2021-07-09 20:37:41.840800] There are [0] clients from [******] │ [2021-07-09 20:37:41.840956] /home/mattf/znc/src/Csocket.cpp:1851 Bad keyfile ... [/certs/mattf/privkey.pem ] │ ``` Still the key seems to be ok: ```bash $ openssl rsa -check -noout -in privkey.pem RSA key ok # mattf @ mattf in /certs/mattf [20:42:44] C:130 $ openssl x509 -modulus -noout -in fullchain.pem | openssl md5 (stdin)= f38d5606c23b48a3e962718406c48fe7 # mattf @ mattf in /certs/mattf [20:42:56] $ openssl rsa -modulus -noout -in privkey.pem | openssl md5 (stdin)= f38d5606c23b48a3e962718406c48fe7 # mattf @ mattf in /certs/mattf [20:45:24] $ ls -Slah /certs/mattf total 32K -rw-r--r-- 1 root root 7.2K Jul 9 21:00 znc.pem -rw-r--r-- 1 root sudo 5.5K Jul 9 21:00 fullchain.pem drwxr-xr-x 2 root sudo 4.0K Jul 9 20:28 . drwxr-xr-x 3 root sudo 4.0K Jul 9 07:10 .. -rw-r--r-- 1 root sudo 1.7K Jul 9 21:00 privkey.pem -rw-r--r-- 1 root sudo 424 Jul 9 21:00 ssl-dhparams.pem $ openssl version │ OpenSSL 1.1.1f 31 Mar 2020 │ ``` And the same key and cert are working on my nginx server. <!-- github-sync-id:941054745 -->
adam commented 2026-10-05 04:57:17 +02:00
Author
Owner
Copy link
Copy source

After removing the extra space after the key file it worked. Would be nice if those variables were stripped!

After removing the extra space after the key file it worked. Would be nice if those variables were stripped! <!-- github-comment-id:877465718 -->
adam commented 2026-10-05 04:57:17 +02:00
Author
Owner
Copy link
Copy source

I'm not sure about removing spaces. It's possible for a filename to have various characters, including spaces. However, limiting this filename to not have spaces at the end looks like a reasonable limitation.

What should be improved for sure, however, is the error message. "File not found" would be clearer than "Bad file"

I'm not sure about removing spaces. It's possible for a filename to have various characters, including spaces. However, limiting this filename to not have spaces at the end looks like a reasonable limitation. What should be improved for sure, however, is the error message. "File not found" would be clearer than "Bad file" <!-- github-comment-id:877485085 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#990