# Add Gemini Support to edbrowse

Currently, edbrowse doesn't support Gemini out of the box, but with a plugin,
it is possible to browse Geminispace. This plugin requires Python 3, and the
ignition library, which can be installed via pip:

```sh
pip3 install ignition-gemini
```

First, you will need to download [ebgmni.py](https://gist.github.com/n0ot/b257e44a414732ef97ca08c00b5a7a93/raw/695f21a61f065e17ab122b5ebe14e84bac2022d2/ebgmni.py) and [ebgmni.sh](https://gist.github.com/n0ot/b257e44a414732ef97ca08c00b5a7a93/raw/695f21a61f065e17ab122b5ebe14e84bac2022d2/ebgmni.sh), and
put them into a directory. I dumped them into
`~/.config/edbrowse/plugins/`, and this is what the rest of this guide assumes
you did. Next, copy the following plugin block into your edbrowse
configuration:

```
plugin {
    type = */*
    desc = Gemini
    protocol = gemini
    program = ~/.config/edbrowse/plugins/ebgmni.sh %i
    outtype = h
}
```


Refresh your config and try browsing to [gemini.circumlunar.space](gemini://gemini.circumlunar.space).

## Client Certificate

Some Gemini sites require you to provide a client certificate, either for authentication, or to act as a sort of cookie. To set this up, you will first need to generate one with openssl. Change to the directory where you extracted the plugin files (`~/.config/edbrowse/plugins/` in my case, and run the following command:

```
openssl req -x509 -newkey rsa:4096 -keyout ebgmni-client.key -out ebgmni-client.crt -days 3653 -sha256 -nodes
```

You can leave the various fields blank when prompted, though you will want to provide a common name, as some sites will identify you by this. The resulting certificate will expire in 10 years.

Finally, add these functions to your edbrowse config to enable and disable the client certificate. For a bit of privacy, you might want to turn it on with `<gmniccon` only when you need it, and then turn it off with `<gmniccoff` afterwards:

```
function:gmniccon {
    db0
    !touch ~/.config/edbrowse/plugins/ebgmni-client-cert-enabled
}

function:gmniccoff {
    db0
    !rm -f ~/.config/edbrowse/plugins/ebgmni-client-cert-enabled
}
```

## Trust-on-first-use

Rather than relying on certificate authorities, Gemini relies on a
trust-on-first-use (TOFU) model to authenticate servers. When edbrowse connects
to a gemini server for the first time, the server will be trusted, but its
server fingerprint will be added to `~/.ebgmni_known_hosts`. If the server's
certificate fingerprint changes for any reason, edbrowse will not connect to
it. Currently, you cannot see the fingerprint of the server you've just
visited, except by opening up this file and looking for it manually.