You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/faq.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -59,11 +59,11 @@ Server operators do not automatically get channel privileges by default. You can
59
59
60
60
- Giving yourself channel operator status using [the samode module](/4/modules/samode).
61
61
62
-
### Why does my server tell me "An unexpected TLS packet was received" or "error:1408F10B:SSL routines:ssl3_get_record:wrong version number:ssl/record/ssl3_record.c" when I try to connect using SSL/TLS?
62
+
### Why does my server tell me "An unexpected TLS packet was received" or "error:1408F10B:SSL routines:ssl3_get_record:wrong version number:ssl/record/ssl3_record.c" when I try to connect using TLS?
63
63
64
-
You are trying to connect using TLS (SSL) but your server is not configured to listen for TLS (SSL) connections.
64
+
You are trying to connect using TLS but your server is not configured to listen for TLS connections.
65
65
66
-
Check that you have a TLS (SSL) module loaded and that your bind tag has the name of a TLS (SSL) profile in `<bind:ssl>`.
66
+
Check that you have a TLS module loaded and that your bind tag has the name of a TLS profile in `<bind:ssl>`.
67
67
68
68
If you're using v3.7.0 or newer you can also use the `inspircd-testssl` script to help diagnose this issue.
@@ -18,24 +18,24 @@ You will also need to install [pkg-config](https://www.freedesktop.org/wiki/Soft
18
18
19
19
If you have these installed before running `./configure` then the appropriate modules will be enabled automatically. If you are installing after building InspIRCd or they were not automatically enabled for some reason you can build them with `./configure --enable-extras module-name-here` and then `make install`.
20
20
21
-
### Acquiring a TLS (SSL) certificate and key
21
+
### Acquiring a TLS certificate and key
22
22
23
-
If you have not already acquired a TLS (SSL) certificate and key you will need to do so. The recommended method of acquiring these files is an ACME client like [Certbot](https://certbot.eff.org/). You can acquire this from either your system package manager or from pip. See [the Certbot installation instructions](https://certbot.eff.org/instructions?ws=other&os=pip) for more information on how to install and configure Certbot. Alternatives to Certbot include [Dehydrated](https://github.com/dehydrated-io/dehydrated), [acme.sh](https://github.com/acmesh-official/acme.sh), and [many others](https://letsencrypt.org/docs/client-options/).
23
+
If you have not already acquired a TLS certificate and key you will need to do so. The recommended method of acquiring these files is an ACME client like [Certbot](https://certbot.eff.org/). You can acquire this from either your system package manager or from pip. See [the Certbot installation instructions](https://certbot.eff.org/instructions?ws=other&os=pip) for more information on how to install and configure Certbot. Alternatives to Certbot include [Dehydrated](https://github.com/dehydrated-io/dehydrated), [acme.sh](https://github.com/acmesh-official/acme.sh), and [many others](https://letsencrypt.org/docs/client-options/).
24
24
25
-
InspIRCd ships with a script called `deploy-ssl.sh` that you can customise for use as a post-deploy hook to automatically reload your TLS (SSL) profiles when your TLS (SSL) certificate and key are updated. Generally this should not require much tweaking but you should check it just in case. If you are using this you should also make sure that your IRC server has [the sslrehashsignal module](/4/modules/sslrehashsignal) loaded (see below).
25
+
InspIRCd ships with a script called `deploy-ssl.sh` that you can customise for use as a post-deploy hook to automatically reload your TLS profiles when your TLS certificate and key are updated. Generally this should not require much tweaking but you should check it just in case. If you are using this you should also make sure that your IRC server has [the sslrehashsignal module](/4/modules/sslrehashsignal) loaded (see below).
26
26
27
-
### Loading and configuring a TLS (SSL) module
27
+
### Loading and configuring a TLS module
28
28
29
-
First you must add a `<module>` tag for the name of the TLS (SSL) module you want to use. e.g. to use the `ssl_gnutls` module use `<module name="ssl_gnutls">`.
29
+
First you must add a `<module>` tag for the name of the TLS module you want to use. e.g. to use the `ssl_gnutls` module use `<module name="ssl_gnutls">`.
30
30
31
-
Once this is added you need to create a TLS (SSL) profile. The syntax of these depend on the TLS (SSL) module that you are using.
31
+
Once this is added you need to create a TLS profile. The syntax of these depend on the TLS module that you are using.
32
32
33
33
-[ssl_gnutls](/4/modules/ssl_gnutls#sslprofile)
34
34
-[ssl_openssl](/4/modules/ssl_openssl#sslprofile)
35
35
36
36
You should note down the value of `<sslprofile:name>` as you will need this in the next step.
37
37
38
-
Now you have a TLS (SSL) profile you can create [a `<bind>` tag](/4/configuration/#bind) with the `sslprofile` key set to the name you specified in `<sslprofile:name>`. This might vary depending on your configuration but it will look something like this:
38
+
Now you have a TLS profile you can create [a `<bind>` tag](/4/configuration/#bind) with the `sslprofile` key set to the name you specified in `<sslprofile:name>`. This might vary depending on your configuration but it will look something like this:
39
39
40
40
```xml
41
41
<bindaddress="*"
@@ -44,18 +44,18 @@ Now you have a TLS (SSL) profile you can create [a `<bind>` tag](/4/configuratio
44
44
type="clients">
45
45
```
46
46
47
-
Once you have added this you should restart your server or run `/REHASH` followed by `/REHASH -ssl` as a server operator to reload both your configuration and your TLS (SSL) profiles.
47
+
Once you have added this you should restart your server or run `/REHASH` followed by `/REHASH -ssl` as a server operator to reload both your configuration and your TLS profiles.
48
48
49
49
### Diagnosing issues
50
50
51
51
InspIRCd ships with a tool named `inspircd-testssl` on binary installations and `./tools/testssl` on source installations. You can run this to diagnose any problems with your server configuration.
52
52
53
53
### Common mistakes
54
54
55
-
In older versions of InspIRCd you configured TLS (SSL) by setting `<bind:ssl>` to the name of a TLS (SSL) module and configuring the TLS (SSL) certificate and key in `<gnutls>`, `<mbedtls>`, or `<openssl>`. Configuring TLS (SSL) in this way is deprecated and will not work if you have a TLS (SSL) profile defined. It is strongly recommended that you do not use this method as it has been removed in the development branch.
55
+
In older versions of InspIRCd you configured TLS by setting `<bind:ssl>` to the name of a TLS module and configuring the TLS certificate and key in `<gnutls>`, `<mbedtls>`, or `<openssl>`. Configuring TLS in this way is deprecated and will not work if you have a TLS profile defined. It is strongly recommended that you do not use this method as it has been removed in the development branch.
56
56
57
-
In v3 TLS (SSL) certificates are not reloaded by default on a regular config rehash. You need to use `/REHASH -ssl` to reload TLS (SSL) certificates or load [the sslrehashsignal module](/4/modules/sslrehashsignal) and send SIGUSR1 to your IRC server. You can also set `<gnutls onrehash="yes">`, `<mbedtls onrehash="yes">`. or `<openssl onrehash="yes>` to reload your TLS (SSL) certificates on rehash.
57
+
In v3 TLS certificates are not reloaded by default on a regular config rehash. You need to use `/REHASH -ssl` to reload TLS certificates or load [the sslrehashsignal module](/4/modules/sslrehashsignal) and send SIGUSR1 to your IRC server. You can also set `<gnutls onrehash="yes">`, `<mbedtls onrehash="yes">`. or `<openssl onrehash="yes>` to reload your TLS certificates on rehash.
58
58
59
-
Certbot provides multiple TLS (SSL) certificate files. If you are getting client errors about missing intermediary certificates you have probably used `cert.pem` as your certificate instead of `fullchain.pem`.
59
+
Certbot provides multiple TLS certificate files. If you are getting client errors about missing intermediary certificates you have probably used `cert.pem` as your certificate instead of `fullchain.pem`.
60
60
61
61
InspIRCd ships with the `inspircd-genssl` tool that allows you to generate a self-signed certificate and key. You can use these for testing your server but you should not use them in production as they do not provide much security over using a plaintext connection and do not work with all clients. This tool will be removed in a future release.
Some IRC spambots are very poorly written and do not support TLS (SSL). You can break these bots by requiring TLS (SSL) on your IRC network. This also has the benefit of preventing your users from having their chats snooped on. To do this you can either disable your plaintext listeners entirely or better still use the IRCv3 STS (Strict Transport Security) feature to redirect users of modern clients to your TLS (SSL) port.
65
+
Some IRC spambots are very poorly written and do not support TLS. You can break these bots by requiring TLS on your IRC network. This also has the benefit of preventing your users from having their chats snooped on. To do this you can either disable your plaintext listeners entirely or better still use the IRCv3 STS (Strict Transport Security) feature to redirect users of modern clients to your TLS port.
0 commit comments