I’ve recently set up ZNC - an IRC bouncer, to help me stay logged in on IRC. Although I’m not yet done with the whole setup, I’ve decided to add a valid certificate. Of course, I use Let’s Encrypt for this purpose.
To issue a certificate you can use:
certbot certonly --standalone -d DOMAIN -n -m YOUREMAIL --agree-tos
Certificate for the ZNC service on FreeBSD is located at:
and it’s structured like:
---PRIVATEKEY--- ---CERTIFICATE--- ---DHParams---
So you probably need to use same structure in that file to have it working properly.
With Let’s Encrypt certificates you need to add full chain (with CA certificate) to that file in order to stop complaints from IRC clients connecting to the server because otherwise, IRC clients such as Konversation prints a warning that it can’t verify the certificate issuer.
Anyhow, to automate renewal process I’ve wrote a little script that replaces certificate when it’s renewed. I assume script is saved into:
file and that it has execute permissions. Full script is as follows:
#!/usr/bin/env sh DOMAIN=irc.tomica.net ZNC_CERT=/usr/local/etc/znc/znc.pem LE_FULLCHAIN=/usr/local/etc/letsencrypt/live/"$DOMAIN"/fullchain.pem LE_PRIVKEY=/usr/local/etc/letsencrypt/live/"$DOMAIN"/privkey.pem DHPARAMS_PATH=/usr/local/etc/ssl DHPARAMS="$DHPARAMS_PATH"/dhparams.pem DATE=$(date +%Y%m%d) # Check if DHParameters exist if [ ! -f $DHPARAMS ] ; then mkdir -p "$DHPARAMS_PATH" openssl dhparam -out "$DHPARAMS" 2048 fi mv "$ZNC_CERT" "$ZNC_CERT"-"$DATE" cat "$LE_PRIVKEY" > "$ZNC_CERT" cat "$LE_FULLCHAIN" >> "$ZNC_CERT" cat "$DHPARAMS" >> "$ZNC_CERT" service znc restart > /dev/null 2>&1
From there, you only need to add cron job to call the script periodically. I’ve set mine to once a week:
0 0 * * 1 /usr/local/bin/certbot renew --standalone --post-hook "/root/bin/le_znc.sh"
I probably don’t need to mention, but I’ll do it anyways. You can use this script after issuing the certificate for the first time as well in order to install that certificate in place of self-signed one that’s automatically generated by ZNC on install time.