How to setup SSL?

[adevoss]

How to setup SSL?

OpenSSL is not available so I use gnutls. Module is enabled. Key and cert (self signed) are created by executing the command in modules.conf (certtool).

Error in log: Module m_ssl_gnutls couldn't load due to configuration problems: Error loading private key: The requested data were not available.

When creating the key and cert I used bogus data except Common name. There I used host.domain.tld.
There were a lot of Y/N questions. Guessed my way through them. What should I have answered?
To test also tried a working Postfix key and cert from another VM with no luck.

Setup: Debian 12 Anope 2.0.12-1 via apt. Inspircd 4.5 on other VM so ssl is mandatory.

[adevoss]

I'm trying to setup SSL in inspircd. ('Handshake Failed - An unexpected TLS packet was received.')
Now in Anope log: Lost connection from uplink #1 (host.domain.tld:7000): Broken pipe

[adevoss]

module
{
        name = "m_ssl_gnutls"

        /*
         * An optional certificate and key for m_ssl_gnutls to give to the uplink.
         *
         * You can generate your own certificate and key pair by using:
         *
         *   certtool --generate-privkey --bits 2048 --outfile anope.key
         *   certtool --generate-self-signed --load-privkey anope.key --outfile anope.crt
         *
         */
        cert = "/etc/anope/anope.crt"
        key = "/etc/anope/anope.key"
}

and

uplink
{
        host = "ircserver1.domain.tld"
        ipv6 = no
        ssl = yes
        port = 7000
        password = "****"
}

uplink
{
        host = "ircserver2.domain.tld"
        ipv6 = no
        ssl = yes
        port = 7000
        password = "****"
}

All is done inside my home LAN (same subnet no fw) on 3 VM's (2x Inspircd, 1x Anope)

[sadiepowell]

Does it work if you disable the AppArmor profile that Debian are shipping? This has been a problem for people in the past.

sudo ln -s /etc/apparmor.d/usr.sbin.anope /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.anope

[adevoss]

Had to add: mkdir /etc/apparmor.d/disable
checked with: aa-status

Still:

Anope 2.0.12 starting up
Loading modules...
Module m_ssl_gnutls couldn't load due to configuration problems: Error loading private key: The requested data were not available.

[sadiepowell]

Can you check the filesystem permissions and owner of your cert and key? They should be readable and owned by the user you want to run as.

[adevoss]

Owner changed from root to irc. That user is used by Debian to run Anope.
Should have figured this out myself. Sorry.

[sadiepowell]

No worries. :)