SSL error on InspIRCd with Cloudflare certificate.
reddit / irc

----------------------------------------------------------------------
sansman7911 · 2022-01-03 02:28

I am trying to implement SSL into my IRC server, I have downloaded and
installed the certificate, key, and ca-bundle from Cloudflare. And I
can connect successfully without SSL but when I do try to use it I get
an error message stating:  "Connection failed (unable to verify the
first certificate.? (21))." I'm not sure why the certificate can't be
verified, and "openssl verify"
 results in an "OK" message. Any help is appeciated.
 message.

My SSL config:

    <gnutls cafile="/etc/inspircd/sslcerts/origin_ca_rsa_root.pem"
certfile="/etc/inspircd/sslcerts/cloudflare.pem"
keyfile="/etc/inspircd/sslcerts/cloudflare.key"
priority="SECURE192:-VERS-SSL3.0"> <module name="m_ssl_gnutls.so">

----------------------------------------------------------------------
ProgVal · 2022-01-03 09:04

What is the output of `openssl s_client -connect <hostname>:6697`?

----------------------------------------------------------------------
sansman7911 · 2022-01-04 00:07

[https://paste.ee/p/TBp1n](https://paste.ee/p/TBp1n)

----------------------------------------------------------------------
ProgVal · 2022-01-04 04:30

You're using the CloudFlare Origin CA. This is a certificate only
meant to be use to encrypt connections between CloudFlare and your
server, not between random clients and your server.

----------------------------------------------------------------------
sansman7911 · 2022-01-04 13:08

Ah, okay, thanks, I didn’t know that. I have setup a self-signed
certificate. Is there a way to get rid of the self signed error
without having to enable the "trust unverified certificate"  button in
my irc client?

----------------------------------------------------------------------
ProgVal · 2022-01-04 22:14

You need to get a certificate from a recognized CA (Certificate
Authority). The most popular one is [Let's
Encrypt](https://letsencrypt.org/).

There are lots of tutorials on the Internet about using it with an
HTTP server; it works in the same way except you would load the
certificates in InspIRCd (with a similar config to what you already
have) instead of nginx/apache/...

----------------------------------------------------------------------
sansman7911 · 2022-01-04 22:16

Alright, thanks!

----------------------------------------------------------------------
[deleted] · 2022-01-26 05:42

[deleted]