sasl.external: connection to server failed (a TLS error occured: io error: No such file or directory (os error 2))

[o-alquimista]

The problem

20:38  ∙ connecting to server...
20:38  ∙ connection to server failed (a TLS error occured: io error: No such file or directory (os error 2))
20:38  ∙ connection to server failed (a TLS error occured: io error: No such file or directory (os error 2))
20:39  ∙ connection to server failed (a TLS error occured: io error: No such file or directory (os error 2))

Configuration

[servers.oftc]
nickname = "removed"
nick_identify_syntax = "password-nick"
server = "irc.oftc.net"
channels = ["#tor-relays"]

[servers.oftc.sasl.external]
cert = "/home/dsilva/.config/irc/oftc.cer"
key = "/home/dsilva/.config/irc/oftc.key"

Location of certificate and key:

$ ls -al
total 20
drwxr-xr-x  2 dsilva dsilva 4096 Aug 31 20:11 .
drwxr-xr-x 39 dsilva dsilva 4096 Aug 31 20:11 ..
-r--------  1 dsilva dsilva 1504 Aug 31 20:11 oftc.cer
-r--------  1 dsilva dsilva 1732 Aug 31 20:11 oftc.key
-r--------  1 dsilva dsilva 3236 Aug 31 20:11 oftc.pem
$ pwd
/home/dsilva/.config/irc

If I comment out the [servers.oftc.sasl.external] section, the connection succeeds. It seems the problem is in this section.

This is on a Linux system (flatpak install). On Windows, I use the same configuration, and it just works there.

---

Worth mentioning: the certificate was generated on Windows (can't remember if it was in Git for Windows or WSL); then I made a backup of it, and now I'm trying to use it on Linux. Is this supposed to work?
I guess I could generate a new key just for Linux. Done that, but no change (same error).

I've generated this certificate by following the OFTC documentation: https://www.oftc.net/NickServ/CertFP/

[o-alquimista]

Flatpak has no permission to read from ~/.config/irc — duh!

So I moved the certificate files into the Halloy configuration folder (a place I know it can read).

[servers.oftc.sasl.external]
cert = "/home/dsilva/.var/app/org.squidowl.halloy/config/halloy/certs/oftc.cer"
key = "/home/dsilva/.var/app/org.squidowl.halloy/config/halloy/certs/oftc.key"

And now it works. *sigh*