Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a ngircd IRC server on Fedora 18 (which was installed using yum), but I'm having some SSL issues. I can connect to the server locally and remotely if I choose to "accept invalid SSL certificates", but get an error otherwise. Here is the XChat output when I try to connect to the IRC server locally:

* Connecting to {domain_name} ({ip_address}) port 6697...
* * Subject: /OU=Domain Control Validated/OU=PositiveSSL/CN={domain_name}
* * Issuer: /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
* * Subject: /OU=Domain Control Validated/OU=PositiveSSL/CN={domain_name}
* * Issuer: /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
* * Subject: /OU=Domain Control Validated/OU=PositiveSSL/CN={domain_name}
* * Issuer: /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
* * Certification info:
*   Subject:
*     OU=Domain Control Validated
*     OU=PositiveSSL
*     CN={domain_name}
*   Issuer:
*     C=GB
*     ST=Greater Manchester
*     L=Salford
*     O=COMODO CA Limited
*     CN=PositiveSSL CA 2
*   Public key algorithm: rsaEncryption (2048 bits)
*   Sign algorithm sha1WithRSAEncryption
*   Valid since Nov  7 00:00:00 2012 GMT to Nov  7 23:59:59 2015 GMT
* * Cipher info:
*   Version: TLSv1/SSLv3, cipher DHE-RSA-AES256-SHA (256 bits)
* Connection failed. Error: unable to verify the first certificate.? (21)

Here is the SSL portion of my ngircd.conf file. I ran ngircd --configtest to test the config file, but it just printed the contents of the file to my terminal.

[SSL]
  CertFile = /etc/pki/tls/certs/{domain_name}.crt
  DHFile = /etc/pki/tls/private/dhparams.pem
  KeyFile = /etc/pki/tls/private/{domain_name}.pem
  KeyFilePassword = {key_file_password}
  Ports = 6697

I've also tried to connect to the server remotely from a Windows 7 x64 machine using mIRC, but had issues there also.

I can't confirm it, but I think Fedora compiles ngircd with GnuTLS and I think my keys were created with OpenSSL. If this were so, would the keys be in a different format? How could I check and convert them?

Is it possible that this is a CA trust issue on both of my machines? If so, how/where can I add the CA root certificates in Fedora 18 and Windows 7 so I don't have this problem?

Are there any other possible causes? Is there's any other information that I should be providing?

share|improve this question

ngircd supports the directive:

[SSL]
CipherList = @SYSTEM

You also want to check the certificate you are using with:

openssl x509 -text -noout -in cert.pem

For Let's Encrypt, I used fullchain.pem and connected to ngircd over SSL on port 6697 with HexChat.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.