CertFP

CertFP is the recommended way to secure your NickServ account. It authenticates you using your client TLS certificate instead of a password.

Generate a certificate

The following creates an Ed25519-compatible certificate and key:

openssl req -x509 -new -newkey ed25519 -sha256 -nodes -out ouch.pem -keyout ouch.pem

Keep ouch.pem private and back it up securely.

Find your fingerprint

Connect with your client configured to use the certificate, then run a WHOIS on yourself. The response includes your certificate fingerprint.

Add the fingerprint to NickServ

While identified to NickServ, run:

/msg NickServ CERT ADD <fingerprint>

Client specifics

ZNC

Enable ZNC’s certificate module and copy ouch.pem into the Certificates section of the web interface.

WeeChat

After creating ouch.pem, put it in a certificate directory such as %h/certs/client.pem. The following settings are an example:

/set irc.server.<network name>.sasl_mechanism external
/set irc.server.<network name>.sasl_password <password>
/set irc.server.<network name>.sasl_username <username>
/set irc.server.<network name>.tls on
/set irc.server.<network name>.tls_cert %h/certs/client.pem
/set irc.server.<network name>.tls_fingerprint A4BC80696DAC936677DE0DCEA429D3B985C8A67449C5E54EB773BE5F5FBE9ECD
/set irc.server.<network name>.tls_verify on

If you are not using Tor, leave the tls_fingerprint option empty.

HexChat

Place the certificate at ~/.config/hexchat/certs/<NetworkName>.pem. On Windows, use %APPDATA%\\HexChat\\certs\\<NetworkName>.pem.

In the Network List, select OuchNet, click Edit, set the port to 6697, enable SSL, and set Login method to SASL EXTERNAL (cert).

When connecting via Tor, use the network’s TLS fingerprint rather than the fingerprint derived from your own certificate.