Skip to content

Commit

Permalink
Update the TLS tutorial to link to both the v3 and v4 docs.
Browse files Browse the repository at this point in the history
  • Loading branch information
SadieCat committed Jun 29, 2024
1 parent e4c917c commit 5b8e2cd
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions docs/tutorials/enable-tls.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ title: How to enable TLS (SSL) on your IRC network

If you are building from source you will need to enable a TLS (SSL) module. Your current options are:

- [ssl_gnutls](/3/modules/ssl_gnutls) — requires [the GnuTLS library](https://gnutls.org).
- [ssl_mbedtls](/3/modules/ssl_mbedtls) — requires [the mbedTLS library](https://tls.mbed.org).
- [ssl_openssl](/3/modules/ssl_openssl) — requires [the OpenSSL library](https://www.openssl.org).
- ssl_gnutls ([v4 docs](/4/modules/ssl_gnutls), [v3 docs](/3/modules/ssl_gnutls)) — requires [the GnuTLS library](https://gnutls.org).
- ssl_mbedtls ([v3 docs](/3/modules/ssl_mbedtls)) — requires [the mbedTLS library](https://tls.mbed.org).
- ssl_openssl ([v4 docs](/4/modules/ssl_openssl), [v3 docs](/3/modules/ssl_openssl)) — requires [the OpenSSL library](https://www.openssl.org).

You will also need to install [pkg-config](https://www.freedesktop.org/wiki/Software/pkg-config/).

Expand All @@ -23,21 +23,21 @@ If you have these installed before running `./configure` then the appropriate mo

If you have not already acquired a TLS (SSL) certificate and key you will need to do so. The recommended method of acquiring these files is an ACME client like [Certbot](https://certbot.eff.org/). You can acquire this from either your system package manager or from pip. See [the Certbot installation instructions](https://certbot.eff.org/instructions?ws=other&os=pip) for more information on how to install and configure Certbot. Alternatives to Certbot include [Dehydrated](https://github.com/dehydrated-io/dehydrated), [acme.sh](https://github.com/acmesh-official/acme.sh), and [many others](https://letsencrypt.org/docs/client-options/).

InspIRCd ships with a script called `deploy-ssl.sh` that you can customise for use as a post-deploy hook to automatically reload your TLS (SSL) profiles when your TLS (SSL) certificate and key are updated. Generally this should not require much tweaking but you should check it just in case. If you are using this you should also make sure that your IRC server has [the sslrehashsignal module](/3/modules/sslrehashsignal) loaded (see below).
InspIRCd ships with a script called `deploy-ssl.sh` that you can customise for use as a post-deploy hook to automatically reload your TLS (SSL) profiles when your TLS (SSL) certificate and key are updated. Generally this should not require much tweaking but you should check it just in case. If you are using this you should also make sure that your IRC server has the sslrehashsignal module ([v4 docs](/4/modules/sslrehashsignal), [v3 docs](/3/modules/sslrehashsignal)) loaded (see below).

### Loading and configuring a TLS (SSL) module

First you must add a `<module>` tag for the name of the TLS (SSL) module you want to use. e.g. to use the `ssl_gnutls` module use `<module name="ssl_gnutls">`.

Once this is added you need to create a TLS (SSL) profile. The syntax of these depend on the TLS (SSL) module that you are using.

- [ssl_gnutls](/3/modules/ssl_gnutls#sslprofile)
- [ssl_mbedtls](/3/modules/ssl_mbedtls#sslprofile)
- [ssl_openssl](/3/modules/ssl_openssl#sslprofile)
- ssl_gnutls ([v4 docs](/4/modules/ssl_gnutls#sslprofile), [v3 docs](/3/modules/ssl_gnutls#sslprofile))
- ssl_mbedtls ([v3 docs](/3/modules/ssl_mbedtls#sslprofile))
- ssl_openssl ([v4 docs](/4/modules/ssl_openssl#sslprofile), [v3 docs](/3/modules/ssl_openssl#sslprofile))

You should note down the value of `<sslprofile:name>` as you will need this in the next step.

Now you have a TLS (SSL) profile you can create [a `<bind>` tag](/3/configuration/#bind) with the `sslprofile` key set to the name you specified in `<sslprofile:name>`. This might vary depending on your configuration but it will look something like this:
Now you have a TLS (SSL) profile you can create a `<bind>` tag ([v4 docs](/4/configuration/#bind), [v3 docs](/3/configuration/#bind)) with the `sslprofile` key set to the name you specified in `<sslprofile:name>`. This might vary depending on your configuration but it will look something like this:

```xml
<bind address="*"
Expand All @@ -56,7 +56,7 @@ InspIRCd ships with a tool named `inspircd-testssl` on binary installations and

In older versions of InspIRCd you configured TLS (SSL) by setting `<bind:ssl>` to the name of a TLS (SSL) module and configuring the TLS (SSL) certificate and key in `<gnutls>`, `<mbedtls>`, or `<openssl>`. Configuring TLS (SSL) in this way is deprecated and will not work if you have a TLS (SSL) profile defined. It is strongly recommended that you do not use this method as it has been removed in the development branch.

By default TLS (SSL) certificates are not reloaded on a regular config rehash. You need to use `/REHASH -ssl` to reload TLS (SSL) certificates or load [the sslrehashsignal module](/3/modules/sslrehashsignal) and send SIGUSR1 to your IRC server. You can also set `<gnutls onrehash="yes">`, `<mbedtls onrehash="yes">`. or `<openssl onrehash="yes>` to reload your TLS (SSL) certificates on rehash.
In v3 TLS (SSL) certificates are not reloaded by default on a regular config rehash. You need to use `/REHASH -ssl` to reload TLS (SSL) certificates or load [the sslrehashsignal module](/3/modules/sslrehashsignal) and send SIGUSR1 to your IRC server. You can also set `<gnutls onrehash="yes">`, `<mbedtls onrehash="yes">`. or `<openssl onrehash="yes>` to reload your TLS (SSL) certificates on rehash.

Certbot provides multiple TLS (SSL) certificate files. If you are getting client errors about missing intermediary certificates you have probably used `cert.pem` as your certificate instead of `fullchain.pem`.

Expand Down

0 comments on commit 5b8e2cd

Please sign in to comment.