Tilde.chat/CertFP

As an alternative to password-based authentication, you can connect to tilde.chat with a TLS certificate and have services recognise it automatically.

For  to work, you must connect over TLS.

Creating a self-signed certificate
In order to follow these instructions, you will need the  utility. If you are using Windows and do not have a copy, you might consider using Cygwin.

You can generate a certificate with the following command:

You will be prompted for various pieces of information about the certificate. The contents do not matter for our purposes, but  needs at least one of them to be non-empty. This certificate will last about 3 years, so consider setting a calendar reminder.

The  file will have the same access to your NickServ account as your password does, so take appropriate care in securing it.

Inspecting your certificate
The expiration date can be checked with the following command:

The fingerprint can be checked with the following command:

Connecting to tilde.chat with your certificate
IRC clients generally differ in where they look for a certificate and how you configure them to offer it to the server. If yours is not yet listed here, advice in this section is unlikely to apply, but guides may be available elsewhere on the web.

irssi
Move the certificates you created above to ~/.irssi/certs

Now configure your  entry for tilde.chat to use this certificate. You may need to adapt this example for your existing configuration (the network and hostname should match what you already use).

weechat
Move the certificates you created above to ~/.weechat/certs

Now disconnect and remove the current tilde.chat server(s). Re-add it with the SSL flag, using your newly generated certificate. Note that these commands are just examples, you have to adapt them to your current servers.

and then reconnect to tilde.chat.

znc
Refer to znc’s official documentation.

HexChat
Place the .pem file in  in the HexChat config directory (  or  ). Note that the  directory does not exist by default and you will have to create it yourself. Once the file is there, all subsequent SSL connections will use the certificate.

If you connect to multiple IRC networks, you should keep in mind that using the filename  will send the same certificate to all networks. If you prefer per-network certificates, use the name of the network exactly as it appears in the network list (Ctrl-S), including capitalisation and punctuation (e.g.  or  ).

Konversation
Create the .pem file as per above, then place it wherever you want. Start Konversation, then open the Identity dialogue by either pressing F8 or via the Settings menu entry. Choose the identity you use for the tilde.chat network or create a new one. In the part  you have to choose   as the   for SASL External or   for CertFP. SASL External requires at least version 1.7 of Konversation. Optionally fill in your account name in the  field. You can then choose the certificate you created with the file picker or enter the path manually in the field next to it. Once done, apply the configuration and (re)connect to tilde.chat.

Revolution
Create the .pem file as per above, transfer it to your Android device, and place it wherever you want ( is a common location). Start Revolution and navigate to the  screen if you are not there already, long-press on the server you wish configure certFP for, and select. When presented with the  screen, tap on   and select , then tap on   and navigate to where where you put the pem file and select it. Tap the tick symbol on the top right of the  screen to save.

Alternatively, Revolution has the ability to generate a client certificate for you. Once you are presented with, there will also be an option to   and when you tap this, a certificate will be randomly generated and a certificate fingerprint will be displayed. Tap the tick symbol on the top right of the screen to save.

Add your fingerprint to NickServ
You can then check whether you have a fingerprint by using  on yourself:

To allow NickServ to recognise you based on your certificate, you need to add the sha512 fingerprint to your account (you will need to log in by other means in order to do so).

You can then authorise your current certificate fingerprint:

In the future, any connections you make to tilde.chat with your certificate will be logged into your account automatically. Optionally, or if you wish to connect via Tor, you can enable SASL with the  mechanism.