SSL handshake failed: Broken pipe connecting to OFTC over irssi on MacOS reddit / irc ---------------------------------------------------------------------- Purple-Ad-3492 · 2022-08-03 21:00 I installed irssi with brew, created a self signed certificate https://www.oftc.net/NickServ/CertFP/#creating-a-self-signed- certificate , connected to oftc with the cert https://www.oftc.net/NickServ/CertFP/#connecting-to-oftc-with-your- cert and keep getting this broken pipe handshake fail. My config profile for oftc references the certificate. I’m connecting using /connect oftc and have also tried /connect -tls irc.oftc.net 6697 ---------------------------------------------------------------------- Kent-C-Aka-Burnout · 2022-11-05 23:40 Check you have the latest SSL Version installed, if that doesn't work check the ssl cert is good made with no errors self signed is ok.. date/time match what the ssl cert is asking for updated. If thats not good, then download Wireshark and run a .pcap when you try to login to see what OSI layer is having a problem. Then post back a url link here to download the problematic .pcap. i'll have a look if you do the last step and still having issues. I had that problem on Windows 8 before, and updating my SSL dll fixed the issue. Try more browsers then Safari to see if it's that causing the problem. Example of myself fixing the Windows 8 SSL Handshake Failure: https://m.youtube.com/watch?v=UnfzcU7ubjk Thanks! ---------------------------------------------------------------------- Purple-Ad-3492 · 2022-11-15 19:04 Thanks for getting back to me on this. As it was 3 months ago I now forget which channel I was intending to connect to when I initiated this process. I did a fresh install of irssi and am still recieving the [same error](https://imgur.com/KFwQzVd) however when attempting to connect. Troubleshooting the process through WireShark for the IP specific to the server it looks [like this](https://imgur.com/ue2Db7N). As I've mentioned I am on MAC so the process in your link wouldn't be a relevant fix in this case. ---------------------------------------------------------------------- Kent-C-Aka-Burnout · 2022-11-15 20:38 To make sure Irssi uses SSL and verifies the authenticity of the certificate, you need to enable certificate verification. You can do this by connecting using the -ssl -ssl_verify flags. Users of Irssi version ≥ 0.8.21 are encouraged to use -tls -tls_verify instead From the bad data packet you posted earlier, it looks like the port isn't reaching when it's trying to connect (it was blurry on my end the .webp file but I could see it). _______________________________________________________ What happens when you try on irssi? _______________________________________________________ Taken from your 1st post above url: /server remove irc.oftc.net /network add OFTC /server add -auto -ssl -ssl_cert ~/.irssi/certs/nick.pem -ssl_verify -network OFTC irc.oftc.net 6697 Next we need to disconnect and connect back to the server /disconnect oftc /connect oftc _______________________________________________________ Try this also and post back the error if you get one: /network add oftc /server add -tls -tls_verify -network oftc irc.oftc.net 6697 /connect oftc _______________________________________________________ I'll verify I can connect using "irc for android" via port 6697 on irc.oftc.net: SRC: larich.oftc.net CMD: 275 DST: ***** EXTRA: ***** ARG: is connected via SSL (secure link) From the bad data packet you posted earlier, it looks like the port isn't reaching the TCP transmission when it's trying to connect (it was blurry on my end the .webp file but I could see it). Verify SSL is installed connecting on another network via irssi to clarify SSL is setup OK If you can, run another .pcap and upload the whole capture to review to narrow down the issue also. Here is what oftc recommends to troubleshoot: If you require assistance with using the OFTC IRC network, - stop by in channel #oftc, or email support@oftc.net with - details. ---------------------------------------------------------------------- Purple-Ad-3492 · 2022-11-15 23:54 Ok I tried both methods and still same error. With TLS, I initially had pf firewall running to allow only port 6697 and 443 through Wi-Fi en0 and [this error.](https://imgur.com/TqZ3E3x) I then enabled mDNS on udp out through 53 and in through 5353 and back to [this error.](https://imgur.com/2egZc94) Same with turning the pf firewall completely off. That method seems insecure so I didn't mess with it too much after that. [Here](https://pastebin.com/uj5LzdXe) is the packet capture with SSL. Some other possible system configuration that could be affecting the connection: I have an application firewall running set to block all incoming connections. It is set to disable automatic allowance of built-in signed software and automatic allowance of downloaded software. I am usually prompted on the initiatory launch of the application (on first run) to allow it. I was not prompted for irssi, but seemed to run fine on it's own through terminal so I don't think that is the issue. Also on WireShark I am able to see which IP's are being denied. ---------------------------------------------------------------------- Kent-C-Aka-Burnout · 2022-11-16 05:31 Destination Address: 207.192.72.99 Transmission Control Protocol, Src Port: 52382, Dst Port: 6697, Seq: 0, Len: 0 Source Port: 52382 Destination Port: 66970 [Stream index: 11] [Conversation completeness: Incomplete, SYN_SENT (1)] ^^^^^^^ Sent the request on irc, but there isn't any response being sent back. That first error you posted showed it didn't know the network name. Check the network is selected as well from /network [A new tcp session is started with the same ports as an earlier session in this trace] [Severity level: Note] [Group: Sequence] [Expert Info (Note/Sequence): This frame is a (suspected) retransmission] [This frame is a (suspected) retransmission] From the capture, it's not reaching the port which is SSL only. I'd leave the firewall off first, and try to remake the SSL self signed cert, and retry the steps again from this url: https://irssi.org/New-users/ When you set your FW, set both TCP and UDP ports together because TCP checks if the connection works, UDP just sends data packets w/o checking. I would also check the ssl cert is completely built correctly self signed, and verify it's working using the commands from my earlier post. It's something being sent from you to the irc server, not being allowed. I would try without ssl to see if irssi connects ok on 6667,etc to ensure irssi is functioning, then try what we discussed. ---------------------------------------------------------------------- Kent-C-Aka-Burnout · 2022-11-16 22:56 Try this out for detailed MacOS SSL Cert: https://blog.devgenius.io/how-to-generate-self-signed-ssl- certificates-b85562830ab This was done real fast just to verify *irssi on Windows 10* 15:45 -!- Irssi: Server irc.oftc.net saved 15:45 -!- Irssi: Looking up irc.oftc.net 15:45 -!- Irssi: Connecting to irc.oftc.net [207.192.72.99] port 6697 15:45 -!- Irssi: Certificate Chain: 15:45 -!- Irssi: Subject: CN: weber.oftc.net 15:45 -!- Irssi: Issuer: C: US, O: Let's Encrypt, CN: R3 15:45 -!- Irssi: Subject: C: US, O: Let's Encrypt, CN: R3 15:45 -!- Irssi: Issuer: C: US, O: Internet Security Research Group, CN: ISRG Root X1 15:45 -!- Irssi: Protocol: TLSv1.3 (256 bit, TLS_AES_256_GCM_SHA384) 15:45 -!- Irssi: EDH Key: 256 bit ECDH: prime256v1 15:45 -!- Irssi: Public Key: 2048 bit RSA, valid from Oct 18 23:27:13 2022 GMT to Jan 16 23:27:12 2023 GMT 15:45 -!- Irssi: Public Key Fingerprint: 61:6F:AC:97:C5:28:9C:14:4A:0B:44:E6:16:10:57:41:BA:09:D4:1F: 5C:DA:57:5D:AA:10:38:66:47:E4:32:98 (SHA256) 15:45 -!- Irssi: Certificate Fingerprint: 32:25:9B:81:8F:5E:05:3C:48:15:88:1D:43:C1:90:6F:7F:C6:B4:77: 69:33:AB:5D:BD:0C:FD:C8:58:BA:5A:16 (SHA256) 15:45 -!- Irssi: (default) warning Could not verify TLS servers certificate: unable to get local issuer certificate 15:45 -!- Irssi: Connection lost to irc.oftc.net 15:46 -!- Irssi: Removed reconnection to server irc.oftc.net port 6697 15:46 -!- Irssi: Looking up irc.oftc.net 15:46 -!- Irssi: Reconnecting to irc.oftc.net [207.192.72.99] port 6697 - use /RMRECONNS to abort 15:46 -!- Irssi: Certificate Chain: 15:46 -!- Irssi: Subject: CN: weber.oftc.net 15:46 -!- Irssi: Issuer: C: US, O: Let's Encrypt, CN: R3 15:46 -!- Irssi: Subject: C: US, O: Let's Encrypt, CN: R3 15:46 -!- Irssi: Issuer: C: US, O: Internet Security Research Group, CN: ISRG Root X1 15:46 -!- Irssi: Protocol: TLSv1.3 (256 bit, TLS_AES_256_GCM_SHA384) 15:46 -!- Irssi: EDH Key: 256 bit ECDH: prime256v1 15:46 -!- Irssi: Public Key: 2048 bit RSA, valid from Oct 18 23:27:13 2022 GMT to Jan 16 23:27:12 2023 GMT 15:46 -!- Irssi: Public Key Fingerprint: 61:6F:AC:97:C5:28:9C:14:4A:0B :44:E6:16:10:57:41:BA:09:D4:1F:5C:DA:57:5D:AA:10:38:66:47:E4:32:98 (SHA256) 15:46 -!- Irssi: Certificate Fingerprint: 32:25:9B:81:8F:5E:05:3C:48:1 5:88:1D:43:C1:90:6F:7F:C6:B4:77:69:33:AB:5D:BD:0C:FD:C8:58:BA:5A:16 (SHA256) 15:46 -!- Irssi: (default) warning Could not verify TLS servers certificate: unable to get local issuer certificate 15:46 -!- Irssi: Connection lost to irc.oftc.net Screenshot: https://ibb.co/RpsvqGW I didn't setup OpenSSL and create cert, just wanted to demonstrate if this would even connect on Windows 10 irssi. ---------------------------------------------------------------------- Purple-Ad-3492 · 2022-11-17 01:42 Ok this must be something to do with the certificate then even though the errors are all SSL handshake failed: broken pipe. ( I turned off both the application firewall and packet filter, generated a new SSL via NickServ/openssl and still same error - [https://imgur.com/a/T6b2xjB](https://imgur.com/a/T6b2xjB) \- this is just with the application firewall turned on but same error with it disabled). If it isn't the certificate I think it's something to do with the routing. I went through the steps in the link you provided, but am not sure what to put in the \[ san \] for DNS and IP when generating the CSR. Would this be my public IP? Edit: Also I'm not 100% familiar with certificate chaining processes and what's required for IRC, and afraid I might be missing some concept entirely of what's neccesary - the initial NickServ link seemed pretty straightforward. This process is something else though - I understand the basic concepts / reasons behind generating client and server certificates and using private keys to verify public keys, but in this process to what regard do I reference myself as server/client and what part is relative to IRC? ---------------------------------------------------------------------- Kent-C-Aka-Burnout · 2022-11-18 05:39 You're going about this correctly: [ san ] DNS.1 = localhost (try whatever your network settings has setup instead, this is issued for 127.0.0.1) IP.1 = 127.0.0.1 (definitely change that to your public IP. That's a loop back IP address for NIC card.) Those should just be for your local machine only. Irssi is definitely the trickiest to setup. Cygwin was what I had to emulate using Windows 10. Normally, most irc clients you don't setup any self signed certs. mIRC I never did, just updated SSL .dll files in the config directory. irc for android the same, I just load the sites in znc, and boom!! SSL is s straight one time setup no self signed cert openssl creation. irssi requires the process you're doing. A suggestion if funds aren't an issue, buy a cheap public ssl cert online, and setup irssi as that's more valid/trusted. https://www.cloudflare.com/pg-lp/free-ssl-tls/?utm_source=google&utm_m edium=cpc&utm_campaign=PAYGO_%7c_ENG_%7c_G_%7c_Search_%7c_DNS_%7c_Appl ications_%7c_CORE&utm_content=&utm_term=free%20ssl%20certificate%20gen erator&campaignid=12293467432&adgroupid=143657385282&creativeid=626190 533960&&_bt=626190533960&_bk=free%20ssl%20certificate%20generator&_bm= e&_bn=g&_bg=143657385282&_placement=&_target=&_loc=1024543&_dv=m&awsea rchcpc=1&gclid=Cj0KCQiA1NebBhDDARIsAANiDD3Cz81RlbgYJ5pJFCp6nn2qG- 7TKK_IPgtWwuAa82fKu8vyMAe0JQcaAub4EALw_wcB&gclsrc=aw.ds Try this site,might be easier and then load as listed from other link you used. That's supposedly free. Try those options and let's see, if you have port forwarding setup, this should resolve itself soon. Try those steps too..thanks! We'll see what happens. ---------------------------------------------------------------------- [deleted] · 2022-11-18 06:49 [deleted] ---------------------------------------------------------------------- Kent-C-Aka-Burnout · 2022-11-23 00:50 Here is my IRSSI via ZNC which has the SSL cert correctly setup (pics included in links) showing my Putty SSH CentOS Linux shell working via Android Phone: If you still have issues, check your SSL cert install, mine shown here worked on OFTC after logging into SSH shell using cmd "irssi": Steps Taken: /network add OFTC /server add -network OFTC irc.oftc.net 6697 /connect OFTC Verified WORKING config via ZNC shell: https://ibb.co/Lzpy0jP https://ibb.co/jWysjff https://ibb.co/5hMYb0z https://ibb.co/LZj3Lkh https://ibb.co/C6T0xVW