certauth

This module lets users log in to ZNC using SSL client keys (CertFP).

Usage

Arguments

This global module takes no arguments.

Read loading modules to learn more about loading modules.

After loading this module, you have to reconnect to ZNC. You can now save your key fingerprint with /msg *certauth add. From now on you can log in to ZNC with any password but it cannot be blank. E.g. you can just send an "user@identifier/network:" as the server password.

Example

After loading certauth and following the steps from ZNC's Cert page to generate SSL certificate, I connect with my SSL client certificate to ZNC:

/msg *certauth help
<*certauth> Commands: show, list, add, del [no]
/msg *certauth show
<*certauth> Your current public key is: 4da806d1fc3e8e24015e3764e8e4264e188d62aa
/msg *certauth list
<*certauth> No keys set for your user
/msg *certauth add
<*certauth> Added your current public key to the list
/msg *certauth list
<*certauth> +----+------------------------------------------+
<*certauth> | Id | Key                                      |
<*certauth> +----+------------------------------------------+
<*certauth> | 1  | 4da806d1fc3e8e24015e3764e8e4264e188d62aa |
<*certauth> +----+------------------------------------------+

Now I reconnect to ZNC again. This time, instead of sending "user/network:password" as the server password, I use "user/network:". Thanks to the SSL client certificate, I can now successfully login without my password!

Ensure you are logging in over TLS so that your certificate actually gets sent.

Webadmin Login

You can use the certificate authentication to login via Webadmin too.

To do it you have to import your certificate in your web browser in PKCS#12 format.

To continue, you should have:

• successfully created an user.pem certificate following the steps from ZNC's Cert page
• saved your key fingerprint with /msg *certauth add command

The next step is to convert the format from PEM to PKCS#12

openssl pkcs12 -export -in user.pem -out user.pkcs12.pfx

You will be asked for a password. It is related to the PKCS#12 certificate, because it has the private key in itself.

Open your browser and navigate to the certificates's page:

• Mozilla Firefox: about:preferences#privacy > Certificates > View Certificates
• Chrome/Chromium: chrome://settings/certificates

Choose Your Certificates tab and import your user.pkcs12.pfx file; insert the password setted in the previous step when requested.

Visit your personal Webadmin page and choose your certificate when prompted.

Fill the username field only and login.

note: some user could encounter some issue to login via certificate due to random settings/old caching/etc; try to use your ZNC's Hostname:port instead of YourNickname during the certificate creation: change the argument "/CN=YourNickname" to "/CN=znc.example.com:6697". Thanks to <CryptoSiD> on Freenode for the tip