Wed 11 Nov 2009 08:03:17 PM UTC, comment #7:
Just to be clear, I set weechat.network.gnutls_ca_file correctly to start with when I was having trouble connecting. The issue was not with the certificate verification but some unknown gnutls error. In my original post it said "gnutls: peer's certificate is trusted".
|
Wed 11 Nov 2009 07:55:56 PM UTC, comment #6:
It also possible to keep « ssl_verify = on » and add the required certificate in WeeChat:
# cat /usr/share/ca-certificates/mozilla/Equifax_Secure_CA.crt >> ~/.weechat/ssl/CAs.pem
(package ca-certificates on Debian)
You have to restart WeeChat to get it working.
|
Wed 11 Nov 2009 07:44:09 PM UTC, comment #5:
Thanks, it seems to have been a temporary problem with the server as I changed irc.server.mozilla.ssl_verify back to "on" and I was able to reconnect.
|
Wed 11 Nov 2009 07:12:25 PM UTC, comment #4:
So I'll set bug status as fixed. If you think there's other problem with new ssl features, just add new comment here.
|
Wed 11 Nov 2009 07:09:12 PM UTC, comment #3:
It works...
irc: connecting to server irc.mozilla.org/6697 (SSL)...
gnutls: connected using 2048-bit Diffie-Hellman shared secret exchange
gnutls: peer's certificate is trusted
gnutls: receiving 1 certificate
- certificate[1] info:
- subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org', issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key
1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
irc: connected to irc.mozilla.org (63.245.208.159)
sand.mozilla.org (sand.mozilla.org): *** Looking up your hostname...
sand.mozilla.org (sand.mozilla.org): *** Found your hostname
Just for info, I set weechat.network.gnutls_ca_file to "/usr/share/ssl/certs/ca-bundle.crt".
|
Wed 11 Nov 2009 06:55:14 PM UTC, comment #2:
Hi Chris,
Can you try /set irc.server.xxxx.ssl_verify off ? (where "xxxx" is your server name)
This should let you connect to server, but this is not trusted, so that's not recommended.
We'll publish doc soon: how to import certificate and use it.
|
Wed 11 Nov 2009 06:01:02 PM UTC, comment #1:
Connecting with gnutls-cli works as expected:-
$ gnutls-cli --x509cafile /usr/share/ssl/certs/ca-bundle.crt -p 6697 irc.mozilla.org
Processed 146 CA certificate(s).
Resolving 'irc.mozilla.org'...
Connecting to '63.245.208.159:6697'...
- Successfully sent 0 certificate(s) to server.
- Server has requested a certificate.
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
- subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org', issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key 1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
- The hostname in the certificate matches 'irc.mozilla.org'.
- Peer's certificate is trusted
- Version: TLS1.0
- Key Exchange: RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed
- Simple Client Mode:
:sand.mozilla.org NOTICE AUTH :*** Looking up your hostname...
:sand.mozilla.org NOTICE AUTH :*** Found your hostname
^C
|
Wed 11 Nov 2009 05:53:39 PM UTC, original submission:
irc: connecting to server irc.mozilla.org/6697 (SSL)...
gnutls: connected using 2048-bit Diffie-Hellman shared secret exchange
gnutls: peer's certificate is trusted
gnutls: receiving 1 certificate
- certificate[1] info:
- subject `C=US,ST=California,L=Mountain View,O=Mozilla Corporation,OU=IRC Chat,CN=irc.mozilla.org',
issuer `C=US,O=Equifax,OU=Equifax Secure Certificate Authority', RSA key 1024 bits, signed using RSA-SHA, activated `2009-08-10 12:34:36 UTC', expires `2011-08-12 10:51:41 UTC', SHA-1 fingerprint `085e2110ed616ebc4d7338c3ce833b20cf7f64b2'
irc: TLS handshake failed
irc: error: GnuTLS internal error.
git commit is c165eab0f2405f7359329c251056138363869ccc (2009-11-11 10:32 Marco Paolone Update italian translations). Host is Linux 2.6.25.3 i686.
|