Port 6697 – IRC over TLS

TCP

Port 6697 is the standard IRC over TLS port – encrypted IRC connections from the first byte. RFC 7194 formally assigned port 6697 for TLS-encrypted IRC in 2014. All modern IRC networks support port 6697 and many now require it. Verify the server certificate to prevent man-in-the-middle downgrades.

Port Number

6697

Protocol

TCP

Service

Internet Relay Chat (SSL/TLS)

Range

IANA Registered (1024–49151)

Description

IRC over TLS on port 6697 provides encrypted client connections to IRC networks. Unlike STARTTLS negotiation on port 6667 (which many servers do not support), port 6697 uses implicit TLS – the connection is encrypted from the TCP handshake, identical to how HTTPS works on port 443. RFC 7194 officially assigned port 6697 for TLS-encrypted IRC in 2014, formalizing a convention that had been in use for years. Libera.Chat, OFTC, and most modern IRC networks require or strongly prefer port 6697. IRC clients should verify the server's TLS certificate and pin known fingerprints for networks they frequently use. Client certificate authentication via TLS (CertFP) on port 6697 provides passwordless NickServ identification.

Security risks

1Certificate validation bypass: some IRC clients do not verify server certificates by default or allow users to accept self-signed certs. An attacker performing a MITM intercepts the TLS connection with their own certificate, and users who click 'accept' lose all encryption protection. Configure clients to reject invalid certificates.
2Outdated TLS versions: legacy IRC servers may support TLS 1.0/1.1 with weak cipher suites. Clients should enforce TLS 1.2+ and prefer AEAD ciphers (AES-GCM, ChaCha20-Poly1305). Check with: openssl s_client -connect server:6697 | grep Protocol.
3CertFP spoofing risk: client certificate fingerprint authentication (CertFP) on port 6697 relies on the uniqueness of the client cert. If a client's private key is compromised, the attacker can impersonate them permanently until the fingerprint is removed from NickServ.

Firewall guidance

If IRC access is permitted on your network, allow only port 6697 (TLS) – never 6667 (plaintext). Whitelist destination IPs to known legitimate IRC networks (Libera.Chat: 130.185.232.0/26, OFTC: 82.195.73.0/24). Monitor for connections to non-whitelisted IPs on 6697 – TLS IRC can also be used for encrypted C2 channels.

Diagnosis commands

Check TLS version, cipher suite, and certificate validity

shell

openssl s_client -connect irc.libera.chat:6697 </dev/null 2>&1 | grep -E '(Protocol|Cipher|Verify)'

Enumerate all supported TLS versions and ciphers on IRC TLS port

shell

nmap -p 6697 --script ssl-enum-ciphers target

Display IRC server certificate details and expiry

shell

openssl s_client -connect server:6697 -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Usage examples

Port 6697 – IRC over TLS

shell

irssi -c irc.libera.chat -p 6697 --tls
weechat: /set irc.server.libera.ssl on
openssl s_client -connect irc.libera.chat:6697

Common services on this port

Libera.ChatOFTCEFnetIRCCloudUnrealIRCdInspIRCdErgo

Related ports

6667

IRC plaintext (insecure predecessor)

6660

IRC alternate range (insecure)

443

HTTPS (similar implicit TLS model)

History

IRC TLS usage predates RFC 7194 – networks offered SSL on various ports (6669, 6697, 7000, 7070) throughout the 2000s. RFC 7194 (2014) officially assigned port 6697 for IRC over TLS, formalizing the most common convention. The RFC was authored by IRC operators to eliminate confusion about which port to use for encrypted IRC. CertFP (client certificate fingerprint) authentication emerged as a passwordless identity mechanism unique to IRC over TLS.

FAQ

What is CertFP and how does it work on port 6697?

CertFP uses your TLS client certificate's SHA-256 fingerprint as an identity proof. Generate a cert: openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -nodes -keyout irc.key -out irc.crt. Configure your IRC client to present it on connection. Register the fingerprint with NickServ: /msg NickServ CERT ADD. Now your nick is automatically identified whenever you connect with that certificate – no password needed.

Specification

RFC 7194 – Port 6697 specification →