From a05abef182846dfe06ee91d1c77838aa78b8049c Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 26 Oct 2025 14:57:51 +0000
Subject: Deprecate the contents of the SSLClientCert namespace.

This is full of footguns and isn't really needed.
---
 include/modules/ssl.h | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

(limited to 'include/modules')

diff --git a/include/modules/ssl.h b/include/modules/ssl.h
index 3d4b459c1..4526d7c9f 100644
--- a/include/modules/ssl.h
+++ b/include/modules/ssl.h
@@ -289,6 +289,7 @@ public:
 	 * @param sock The socket to get the certificate from, the socket does not have to use TLS
 	 * @return The TLS client certificate information, NULL if the peer is not using TLS
 	 */
+	[[deprecated("Use SSLIOHook::IsSSL()->GetCertificate() instead")]]
 	static ssl_cert* GetCertificate(StreamSocket* sock)
 	{
 		SSLIOHook* ssliohook = SSLIOHook::IsSSL(sock);
@@ -305,12 +306,18 @@ public:
 	 * @return The key fingerprint from the TLS certificate sent by the peer,
 	 * empty if no cert was sent or the peer is not using TLS
 	 */
+	[[deprecated("Use SSLIOHook::IsSSL()->GetCertificate()->GetFingerprint() instead")]]
 	static std::string GetFingerprint(StreamSocket* sock)
 	{
-		ssl_cert* cert = SSLClientCert::GetCertificate(sock);
-		if (cert)
-			return cert->GetFingerprint();
-		return "";
+		auto* ssliohook = SSLIOHook::IsSSL(sock);
+		if (!ssliohook)
+			return nullptr;
+
+		auto* cert = ssliohook->GetCertificate();
+		if (!cert)
+			return "";
+
+		return cert->GetFingerprint();
 	}
 };
 
-- 
cgit v1.3.1-10-gc9f91


From d424d2ef710b4f45c06bfad79089bd998d5a35f9 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 26 Oct 2025 15:12:17 +0000
Subject: Fix allowing expired client certificates in some cases.

This fixes a regression from v3.
---
 include/modules/ssl.h     | 6 +++---
 src/modules/m_sslinfo.cpp | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'include/modules')

diff --git a/include/modules/ssl.h b/include/modules/ssl.h
index 4526d7c9f..ff2646e8b 100644
--- a/include/modules/ssl.h
+++ b/include/modules/ssl.h
@@ -314,7 +314,7 @@ public:
 			return nullptr;
 
 		auto* cert = ssliohook->GetCertificate();
-		if (!cert)
+		if (!cert || !cert->IsUsable())
 			return "";
 
 		return cert->GetFingerprint();
@@ -355,7 +355,7 @@ public:
 	std::string GetFingerprint(User* user)
 	{
 		ssl_cert* cert = GetCertificate(user);
-		if (cert)
+		if (cert && cert->IsUsable())
 			return cert->GetFingerprint();
 		return "";
 	}
@@ -368,7 +368,7 @@ public:
 	std::vector<std::string> GetFingerprints(User* user)
 	{
 		ssl_cert* cert = GetCertificate(user);
-		if (cert)
+		if (cert && cert->IsUsable())
 			return cert->GetFingerprints();
 		return {};
 	}
diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index 4a1f73f74..bebd08155 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -373,7 +373,7 @@ public:
 			whois.SendLine(RPL_WHOISSECURE, "is using a secure connection");
 
 		ssl_cert* cert = cmd.sslapi.GetCertificate(whois.GetTarget());
-		if (cert)
+		if (!cert || !cert->IsUsable())
 		{
 			if (!cmd.operonlyfp || whois.IsSelfWhois() || whois.GetSource()->IsOper())
 			{
@@ -415,7 +415,7 @@ public:
 		}
 
 		const std::string fingerprint = oper->GetConfig()->getString("fingerprint");
-		if (!fingerprint.empty() && (!cert || !MatchFingerprint(cert, fingerprint)))
+		if (!fingerprint.empty() && (!cert || !cert->IsUsable() || !MatchFingerprint(cert, fingerprint)))
 		{
 			if (!automatic)
 			{
-- 
cgit v1.3.1-10-gc9f91


From ca036a1160b55bea79e8328acbde5a736e13d13c Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 26 Oct 2025 15:20:33 +0000
Subject: Fix a typo in a previous commit's deprecation message.

---
 include/modules/ssl.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'include/modules')

diff --git a/include/modules/ssl.h b/include/modules/ssl.h
index ff2646e8b..ed795eddd 100644
--- a/include/modules/ssl.h
+++ b/include/modules/ssl.h
@@ -306,7 +306,7 @@ public:
 	 * @return The key fingerprint from the TLS certificate sent by the peer,
 	 * empty if no cert was sent or the peer is not using TLS
 	 */
-	[[deprecated("Use SSLIOHook::IsSSL()->GetCertificate()->GetFingerprint() instead")]]
+	[[deprecated("Use SSLIOHook::IsSSL()->GetFingerprint() instead")]]
 	static std::string GetFingerprint(StreamSocket* sock)
 	{
 		auto* ssliohook = SSLIOHook::IsSSL(sock);
-- 
cgit v1.3.1-10-gc9f91