On Wed, Nov 15, 2023 at 12:13:15AM -0500, Viktor Dukhovni wrote:
It must be that Let's Encrypt finally stopped by default including that cross certificate in their chains.
As pointed out helpfully by Geert Hendrickx on the postfix-users list:
They plan to stop providing the cross-signed "long chain" by default in February 2024, and completely in June, as the cross-sign expires in September. Dropping it last week was unintended.
The ensuing conversation on the LE forum uncovered a second potential future incompatibility to plan for:
https://community.letsencrypt.org/t/short-chain-and-dane/208422/8?u=ietf-dan...
Let's Encrypt are apparently also planning to *randomise* the choice of intermediate issuer CA used with each renewal. Instead of consistently using say "R3", they'll randomly choose one of R3/R4/E1/E2.
Therefore, anyone who publishes TLSA records for just one of the 4 issuers, will eventually also be "disappointed".
If you're using Let's Encrypt as your CA and prefer to publish DANE-TA(2), rather than DANE-EE(3) TLSA records, please look over:
http://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html
carefully, and publish all four of the **required** TLSA records, for each MX host:
_25._tcp.mx1.org.example. IN TLSA 2 1 1 8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d ; R3 _25._tcp.mx1.org.example. IN TLSA 2 1 1 e5545e211347241891c554a03934cde9b749664a59d26d615fe58f77990f2d03 ; R4 _25._tcp.mx1.org.example. IN TLSA 2 1 1 276fe8a8c4ec7611565bf9fce6dcace9be320c1b5bea27596b2204071ed04f10 ; E1 _25._tcp.mx1.org.example. IN TLSA 2 1 1 bd936e72b212ef6f773102c6b77d38f94297322efc25396bc3279422e0c89270 ; E2 ...
or if you prefer:
_25._tcp.mx1.org.example. IN CNAME _25._tlsa.org.example. _25._tcp.mx2.org.example. IN CNAME _25._tlsa.org.example. ... _25._tcp.mxN.org.example. IN CNAME _25._tlsa.org.example. ; _25._tlsa.org.example. IN TLSA 2 1 1 8d02536c887482bc34ff54e41d2ba659bf85b341a0a20afadb5813dcfbcf286d ; R3 _25._tlsa.org.example. IN TLSA 2 1 1 e5545e211347241891c554a03934cde9b749664a59d26d615fe58f77990f2d03 ; R4 _25._tlsa.org.example. IN TLSA 2 1 1 276fe8a8c4ec7611565bf9fce6dcace9be320c1b5bea27596b2204071ed04f10 ; E1 _25._tlsa.org.example. IN TLSA 2 1 1 bd936e72b212ef6f773102c6b77d38f94297322efc25396bc3279422e0c89270 ; E2