Improve the error logging when opering up with a TLS fingerprint.

1 files changed, 17 insertions, 4 deletions

diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index bebd08155..428083fc1 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -414,13 +414,26 @@ public:
 			return MOD_RES_DENY;
 		}
 
-		const std::string fingerprint = oper->GetConfig()->getString("fingerprint");
-		if (!fingerprint.empty() && (!cert || !cert->IsUsable() || !MatchFingerprint(cert, fingerprint)))
+		const auto fingerprint = oper->GetConfig()->getString("fingerprint");
+		if (fingerprint.empty())
+			return MOD_RES_PASSTHRU;
+
+		const auto cert_usable = cert && cert->IsUsable();
+		const auto correct_fp = cert_usable && MatchFingerprint(cert, fingerprint);
+		if (!correct_fp)
 		{
 			if (!automatic)
 			{
-				ServerInstance->SNO.WriteGlobalSno('o', "{} ({}) [{}] failed to log into the \x02{}\x02 oper account because they are not using the correct TLS client certificate.",
-					user->nick, user->GetRealUserHost(), user->GetAddress(), oper->GetName());
+				const char* error;
+				if (!cert)
+					error = "not using a TLS client certificate";
+				if (!cert_usable)
+					error = "using an invalid (probably expired) TLS client certificate";
+				else
+					error = "not using the correct TLS client certificate";
+
+				ServerInstance->SNO.WriteGlobalSno('o', "{} ({}) [{}] failed to log into the \x02{}\x02 oper account because they are {}.",
+					user->nick, user->GetRealUserHost(), user->GetAddress(), oper->GetName(), error);
 			}
 			return MOD_RES_DENY;
 		}