From a76e75f609104518cda2909b55d70d9b3d525c6c Mon Sep 17 00:00:00 2001
From: Pavel Djundik <xPaw@users.noreply.github.com>
Date: Fri, 30 Oct 2020 22:56:05 +0200
Subject: [PATCH] Do not generate and send client certificate unless SASL
 EXTERNAL is requested

Fixes #4092
---
 src/models/network.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/models/network.js b/src/models/network.js
index a2e4a946..e137a137 100644
--- a/src/models/network.js
+++ b/src/models/network.js
@@ -204,8 +204,7 @@ Network.prototype.setIrcFrameworkOptions = function (client) {
 	this.irc.options.tls = this.tls;
 	this.irc.options.rejectUnauthorized = this.rejectUnauthorized;
 	this.irc.options.webirc = this.createWebIrc(client);
-
-	this.irc.options.client_certificate = this.tls ? ClientCertificate.get(this.uuid) : null;
+	this.irc.options.client_certificate = null;
 
 	if (!this.sasl) {
 		delete this.irc.options.sasl_mechanism;
@@ -213,6 +212,7 @@ Network.prototype.setIrcFrameworkOptions = function (client) {
 	} else if (this.sasl === "external") {
 		this.irc.options.sasl_mechanism = "EXTERNAL";
 		this.irc.options.account = {};
+		this.irc.options.client_certificate = ClientCertificate.get(this.uuid);
 	} else if (this.sasl === "plain") {
 		delete this.irc.options.sasl_mechanism;
 		this.irc.options.account = {