irc: TLS handshake failed
irc: error: The operation was cancelled due to user error

update-ca-certificates -f

$ sudo slackpkg reinstall openssl-1.1.0h-x86_64-2 openssl-solibs-1.1.0h-x86_64-2  openssl10-1.0.2o-x86_64-1  openssl10-solibs-1.0.2o-x86_64-1

+--------------------------+
Tue Jul 17 21:16:10 UTC 2018
Happy 25th anniversary to the Slackware 1.00 release! When the original
announcement went out on Usenet, I believe it had a UTC timestamp which has
led to some confusion over whether the anniversary falls on the 16th (which
was the date when I made the post) or on the 17th (which is when most people
first saw it)... but really, what's the difference? We can celebrate on both
days as far as I'm concerned. Thanks for sticking with the project all these
years. Glad I was able to help. :)
Here's a link to the 1.00 announcement:
  http://www.slackware.com/announce/1.0.php
And here's a nice article that was posted on opensource.com:
  https://opensource.com/article/18/7/stackware-turns-25
a/kernel-firmware-20180717_8d69bab-noarch-1.txz:  Upgraded.
l/pulseaudio-12.2-x86_64-1.txz:  Upgraded.
n/gnutls-3.6.3-x86_64-1.txz:  Upgraded.
n/mutt-1.10.1-x86_64-1.txz:  Upgraded.
  This update fixes bugs and security issues. Upstream strongly recommends
  that all IMAP and POP users upgrade as soon as possible.
  (* Security fix *)
+--------------------------+

update-ca-certificates -f

* Looking up chat.freenode.net
* Connecting to chat.freenode.net (162.213.39.42:6697)
* * Subject: /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
* * Issuer: /O=Digital Signature Trust Co./CN=DST Root CA X3
* * Subject: /CN=weber.freenode.net
* * Issuer: /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3
* * Certification info:
*   Subject:
*     CN=weber.freenode.net
*   Issuer:
*     C=US
*     O=Let's Encrypt
*     CN=Let's Encrypt Authority X3
*   Public key algorithm: rsaEncryption (4096 bits)
*   Sign algorithm sha256WithRSAEncryption
*   Valid since Jun 18 05:01:12 2018 GM to Sep 16 05:01:12 2018 GM
* * Cipher info:
*   Version: TLSv1.2, cipher DHE-RSA-AES256-GCM-SHA384 (256 bits)
* Connection failed (unable to get local issuer certificate.? (20))

diff --git a/lib/cert-cred.c b/lib/cert-cred.c
index d3777e51f..2150e903f 100644
--- a/lib/cert-cred.c
+++ b/lib/cert-cred.c
@@ -387,6 +387,13 @@ static int call_legacy_cert_cb1(gnutls_session_t session,
 	if (ret < 0)
 		return gnutls_assert_val(ret);
 
+	if (st2.ncerts == 0) {
+		*pcert_length = 0;
+		*ocsp_length = 0;
+		*privkey = NULL;
+		return 0;
+	}
+
 	if (st2.cert_type != GNUTLS_CRT_X509) {
 		gnutls_assert();
 		ret = GNUTLS_E_INVALID_REQUEST;
@@ -503,7 +510,10 @@ void gnutls_certificate_set_retrieve_function
      gnutls_certificate_retrieve_function * func)
 {
 	cred->legacy_cert_cb1 = func;
-	cred->get_cert_callback3 = call_legacy_cert_cb1;
+	if (!func)
+		cred->get_cert_callback3 = NULL;
+	else
+		cred->get_cert_callback3 = call_legacy_cert_cb1;
 }
 
 static int call_legacy_cert_cb2(gnutls_session_t session,
@@ -578,7 +588,10 @@ void gnutls_certificate_set_retrieve_function2
      gnutls_certificate_retrieve_function2 * func) 
 {
 	cred->legacy_cert_cb2 = func;
-	cred->get_cert_callback3 = call_legacy_cert_cb2;
+	if (!func)
+		cred->get_cert_callback3 = NULL;
+	else
+		cred->get_cert_callback3 = call_legacy_cert_cb2;
 }
 
 /**
diff --git a/lib/hello_ext.c b/lib/hello_ext.c
index a3027130a..f72afe77f 100644
--- a/lib/hello_ext.c
+++ b/lib/hello_ext.c
@@ -208,7 +208,7 @@ int hello_ext_parse(void *_ctx, unsigned tls_id, const uint8_t *data, unsigned d
 
 	if (tls_id == PRE_SHARED_KEY_TLS_ID) {
 		ctx->seen_pre_shared_key = 1;
-	} else if (ctx->seen_pre_shared_key) {
+	} else if (ctx->seen_pre_shared_key && session->security_parameters.entity == GNUTLS_SERVER) {
 		/* the pre-shared key extension must always be the last one,
 		 * draft-ietf-tls-tls13-28: 4.2.11 */
 		return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);