# For Freenode IRC
mapaddress 10.40.40.40 freenodeok2gncmy.onion

$ openssl req -x509 -sha256 -new -newkey rsa:4096 -days 1000 -nodes
              -out FreenodeTor.pem -keyout FreenodeTor.pem
Generating a 4096 bit RSA private key
...
Common Name (e.g. server FQDN or YOUR name) []: mary
$ mkdir -p ~/.irssi/certs
$ mv FreenodeTor.pem ~/.irssi/certs/

$ openssl x509 -in ~/.irssi/certs/FreenodeTor.pem -outform der
  | sha1sum -b | cut -d' ' -f1

$ irssi
[(status)] /connect irc.freenode.net
[(status)] /msg NickServ CERT ADD <fingerprint from step 3.>

[(status)] /network add -sasl_username mary -sasl_password m1nt_545c3 -sasl_mechanism EXTERNAL FreenodeTor
[(status)] /server add -ssl -ssl_cert ~/.irssi/certs/FreenodeTor.pem -net FreenodeTor 10.40.40.40 6697

[(status)] /ignore * CTCPS
[(status)] /save
[(status)] /quit

servers = (
  ...
  {
    address = "10.40.40.40";
    chatnet = "FreenodeTor";
    port = "6697";
    use_tls = "yes";
    tls_cert = "~/.irssi/certs/FreenodeTor.pem";
    tls_verify = "no";
    autoconnect = "no";
  }
);

chatnets = {
  ...
  FreenodeTor = {
    type = "IRC";
    max_kicks = "1";
    max_msgs = "4";
    max_whois = "1";
    sasl_mechanism = "external";
    sasl_username = "mary";
    sasl_password = "m1nt_545c3";
  };
};

settings = {
  core = { real_name = "mary"; user_name = "mary"; nick = "mary"; };
  ...
};
ignores = ( { level = "CTCPS"; } );

$ torsocks irssi
[(status)] /connect FreenodeTor

22:02 -!- Irssi: Connecting to 10.40.40.40 [10.40.40.40] port 6697
22:02 -!- Irssi: Certificate Chain:
22:02 -!- Irssi:   Subject: CN: zettel.freenode.net
22:02 -!- Irssi:   Issuer:  C: US, O: Let's Encrypt, CN: Let's Encrypt Authority X3
22:02 -!- Irssi:   Subject: C: US, O: Let's Encrypt, CN: Let's Encrypt Authority X3
22:02 -!- Irssi:   Issuer:  O: Digital Signature Trust Co., CN: DST Root CA X3
22:02 -!- Irssi: Protocol: TLSv1.2 (256 bit, DHE-RSA-AES256-GCM-SHA384)
22:02 -!- Irssi: EDH Key: 2048 bit DH
22:02 -!- Irssi: Public Key: 4096 bit RSA, valid from Mar  6 05:01:00 2017 GMT to Jun  4 05:01:00 2017 GMT
22:02 -!- Irssi: Public Key Fingerprint:  E0:1B:31:80:56:D9:78:C4:2B:2D:3F:B2:DB:81:AB:03:15:59:BF:04:7E:31:E8:60:5F:98:07:A1:BB:8F:A3:0D (SHA256)
22:02 -!- Irssi: Certificate Fingerprint: B3:2B:29:0D:01:45:8F:3A:08:78:81:21:8B:72:CF:E4:9F:B1:53:D2:DB:AB:52:0B:38:2A:8F:94:ED:87:65:BA (SHA256)
22:02 -!- Irssi: Connection to 10.40.40.40 established
22:02 !zettel.freenode.net *** Looking up your hostname...
22:02 !zettel.freenode.net *** Couldn't look up your hostname
22:02 -!- mary!mary@127.0.0.1 mary You are now logged in as mary.
22:02 -!- SASL authentication succeeded
22:02 !zettel.freenode.net *** Spoofing your IP
22:02 -!- Welcome to the freenode Internet Relay Chat Network mary
22:02 -!- Your host is zettel.freenode.net[127.0.0.1/12345], running version ircd-seven-1.1.4