April 2016 - dane-users

Best practice TLSA RRs for CA-issued certs
by Viktor Dukhovni 30 Dec '16

30 Dec '16

[ This assumes you are willing to trust your issuer CA to not misissue certificates for your domain, and include the CA certificate in your server chain file. ] One approach to making sure that DANE TLSA records are less likely to fail that should work well for sites using CA-issued certificates is to publish both "3 1 1" and "2 1 1" TLSA records: mx.example. IN TLSA 3 1 1 <digest of server public key> mx.example. IN TLSA 2 1 1 <digest of immediate issuer public key> * The "3 1 1" record protects against "expiration" accidents, and unexpected changes in the issuer's public key (if new certificate chain deployment is automated). * The "2 1 1" record protects against key rotation errors should a a new server private key be deployed without updating the TLSA RRs. Provided the new certificate is issued by the same CA is unexpired, ... the "2 1 1" record will match. With a bit of monitoring to ensure that both records match, simultaneous failure of both is much less likely. This even makes it possible to avoid pre-deployment DNS TLSA records updates when rotating certificates, provided at least one of the issuer public key or the server public key is unchanged in the new chain. In particular, this is the best practice with Let's Encrypt issued SMTP server certificates, as explained in: https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certifi… -- Viktor.

3 13

NEWSFLASH: DANE TLSA records published for web.de!
by Viktor Dukhovni 21 Apr '16

21 Apr '16

The web.de domain has just published DANE TLSA records for its MX hosts: web.de. IN MX 100 mx-ha02.web.de. ; AD=1 _25._tcp.mx-ha02.web.de. IN TLSA 3 1 1 409c9e91a2a9f4d7881dbf0094b3839d4343a4a57d9bf559fdeb0c1f4c5b8b3e ; passed Subject = CN=mx-ha02.web.de,emailAddress=server-certs(a)1und1.de,L=Montabaur,ST=Rhineland-Palatinate,O=1&1 Mail & Media GmbH,C=DE Issuer = CN=TeleSec ServerPass DE-2,street=Untere Industriestr. 20,L=Netphen,postalCode=57250,ST=Nordrhein Westfalen,OU=T-Systems Trust Center,O=T-Systems International GmbH,C=DE Inception = 2014-07-22T11:21:46Z Expiration = 2017-07-27T23:59:59Z web.de. IN MX 100 mx-ha03.web.de. ; AD=1 _25._tcp.mx-ha03.web.de. IN TLSA 3 1 1 33fccf0e82584b6133cf18d24ae592cc6cbc9cfcab13291a5585a2b20a30eb19 ; passed Subject = CN=mx-ha03.web.de,emailAddress=server-certs(a)1und1.de,L=Montabaur,ST=Rhineland-Palatinate,O=1&1 Mail & Media GmbH,C=DE Issuer = CN=TeleSec ServerPass DE-2,street=Untere Industriestr. 20,L=Netphen,postalCode=57250,ST=Nordrhein Westfalen,OU=T-Systems Trust Center,O=T-Systems International GmbH,C=DE Inception = 2014-07-22T11:22:46Z Expiration = 2017-07-27T23:59:59Z This is a major milestone in DANE adoption. -- Viktor.

4 4

education.lu
by Wolfgang Breyha 08 Apr '16

08 Apr '16

Hi! I'm testing the new exim 4.85 DANE support and it took only some days to get in trouble... One of our users tried to send mail to the domain education.lu. Their domain and MX hosts are DNSSEC enabled and have TLSA RRs. The DANE validator https://dane.sys4.de/smtp/education.lu says: "Unusable TLSA Records". Most likely because it is type 1 not allowed for DANE-SMTP? I've set hosts_try_dane = * in my SMTP transport. Exim refuses to talk to those hosts at all with "failure while setting up TLS session". Is this expected behavior in terms of DANE-SMTP? What's postfix doing in this case? Greetings, Wolfgang -- Wolfgang Breyha <wbreyha(a)gmx.net> | http://www.blafasel.at/ Vienna University Computer Center | Austria

8 29