IRC Guides · Getting started

TLS certificates for IRC

Intermediate · about 15 min read

TLS (often still called SSL in IRC clients) encrypts traffic between your client and the server so passwords and messages are not sent in clear text on the network path.

As a user (client)

• Prefer port 6697 (or the network’s published TLS port) over 6667
• Enable “Use SSL/TLS” / “SSL” for that server entry
• If the client warns about a certificate, check you have the correct hostname — do not blindly ignore errors on public networks

Example style settings (names vary by client):

Host: irc.example.org
Port: 6697
TLS:  enabled

Bouncers such as ZNC should also be reached over TLS when possible — see ZNC bouncer.

As a server admin (Let’s Encrypt)

For UnrealIRCd or a public ZNC host, use a real certificate (Let’s Encrypt is common):

sudo apt install certbot
sudo certbot certonly --standalone -d irc.example.org
# certificates typically under:
# /etc/letsencrypt/live/irc.example.org/fullchain.pem
# /etc/letsencrypt/live/irc.example.org/privkey.pem

Point UnrealIRCd’s listen/TLS blocks at those files (exact syntax depends on version — see upstream docs). Reload or restart after renewals; certbot renew hooks can rehash the IRCd.

Eggdrop

Modern Eggdrop can connect to IRC with TLS and protect botnet links. Generate certs during install (make sslcert) and enable TLS options in the config. Details: Enabling TLS on Eggdrop.