ERC is fully equipped to connect to SSL/TLS-enabled servers (e.g. OFTC and Freenode) however, Certificate Authentication support is rather untested.
For the purposes of this guide, head on over to the following OFTC page to get an idea on how to create the necessary certificates
Hack away at your init files, ensuring that SSL/TLS support is enabled:
This allows us to set the tls-program variable that calls external tools “openssl” or “gnutls-cli” to perform the actual connection.
To see how the variable is initally defined:
[F1] V tls-program
You’ll notice that there are several options for tls-program. tls-program will cycle through the commands until a connection is established with the fallback.
Please note that while you can add CA-chain & accompanying keys to gnutls-cli, ERC may fail to recognise them, and will proceed to create the secure connection using gnutls without certificate authentication.
It is this reason alone that I have opted for openssl:
(setq tls-program '("openssl s_client -connect %h:%p -no_ssl2 -ign_eof -CAfile /home/ootput/.private/certs/CAs.pem -cert /home/ootput/.private/certs/nick.pem" "gnutls-cli --priority secure256 --x509cafile /home/ootput/.private/certs/CAs.pem --x509certfile /home/ootput/.private/certs/nick.pem -p %p %h" "gnutls-cli --priority secure256 -p %p %h"))
Please note that your distro’s implementation of libgnutls may be unsuitable for CA-chaining, as was my case.
Use of gnutls-cli is recommended in the future, however, as most linux projects have sought to replace openssl dependencies with gnutls
Now, assuming you’ve already enabled ‘erc, we can continue to work with the supplied erc-tls command:
; M-x start-irc (defun start-irc () "Connect to IRC." (interactive) (erc-tls :server "irc.oftc.net" :port 6697 :nick "ootput" :full-name "ootput") (erc :server "irc.freenode.net" :port 6667 :nick "ootput" :full-name "ootput") (setq erc-autojoin-channels-alist '(("freenode.net" "#emacs" "#screen" "#ion") ("oftc.net" "#debian"))))
This will establish connection to OFTC on port 6697 (SSL), but more importantly, it will allow us to use certificates for transparent Nickserv auth.
Enjoy your SSL-encrypted IRC session!
While the start-irc will initiate the cert-based ssl connection, a terminated connection will fail to trigger an auto-reconnect with certs. In the absence of valid ssl credentials, this will mean repeated failed attempts to reconnect. A temporary solution would be to have nickserv login and password saved to an erc-auth file to be loaded by erc. – ootput
Yeah, that's an issue indeed. As a temporary hotfix I set erc-server-auto-reconnect to nil
Hey, put (require ‘erc) in your ~/.emacs. – talau
I followed the tutorial on creating the cert keys and I have Nick.cer, Nick.key and Nick.pem. When I go to configure the tls-program variable, the -CAfile option requires CAs.pem. This tutorial doesn’t explain where to get this file from. – E1f
You skipped a part of the tutorial, E1f. Check under “Connecting to OFTC with your Cert” → “Unlisted Clients” → “Irssi”, and adjust for your designated paths. – ootput
When using emacs24, I am no longer seeing the openssl process running on my system so I assume it uses a built-in tls library. The certificate isn’t passed in the SSL session either. – vled
Emacs24 doesn’t bother validating the server certificate when using the built-in TLS support either, so the NSA could be right there in the middle and you’d never know. ☹ --seanl