From d188d5e21314773ef1167facd0cb1d9681ef20ad Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sat, 1 Nov 2025 11:23:16 +0000
Subject: Improve the error logging when opering up with a TLS fingerprint.

---
 src/modules/m_sslinfo.cpp | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

(limited to 'src/modules/m_sslinfo.cpp')

diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp
index bebd08155..428083fc1 100644
--- a/src/modules/m_sslinfo.cpp
+++ b/src/modules/m_sslinfo.cpp
@@ -414,13 +414,26 @@ public:
 			return MOD_RES_DENY;
 		}
 
-		const std::string fingerprint = oper->GetConfig()->getString("fingerprint");
-		if (!fingerprint.empty() && (!cert || !cert->IsUsable() || !MatchFingerprint(cert, fingerprint)))
+		const auto fingerprint = oper->GetConfig()->getString("fingerprint");
+		if (fingerprint.empty())
+			return MOD_RES_PASSTHRU;
+
+		const auto cert_usable = cert && cert->IsUsable();
+		const auto correct_fp = cert_usable && MatchFingerprint(cert, fingerprint);
+		if (!correct_fp)
 		{
 			if (!automatic)
 			{
-				ServerInstance->SNO.WriteGlobalSno('o', "{} ({}) [{}] failed to log into the \x02{}\x02 oper account because they are not using the correct TLS client certificate.",
-					user->nick, user->GetRealUserHost(), user->GetAddress(), oper->GetName());
+				const char* error;
+				if (!cert)
+					error = "not using a TLS client certificate";
+				if (!cert_usable)
+					error = "using an invalid (probably expired) TLS client certificate";
+				else
+					error = "not using the correct TLS client certificate";
+
+				ServerInstance->SNO.WriteGlobalSno('o', "{} ({}) [{}] failed to log into the \x02{}\x02 oper account because they are {}.",
+					user->nick, user->GetRealUserHost(), user->GetAddress(), oper->GetName(), error);
 			}
 			return MOD_RES_DENY;
 		}
-- 
cgit v1.3.1-10-gc9f91