Damned, don’t any short documentation. :-( I’ve seen this on a website with a howto. I will test with all smtp Ports. This should work for pop3s and imaps, too, shouldn’t it? What is about pop3 and imap with TLS, the same? Frank

Am 11.02.2015 um 12:44 schrieb John :

That should have read - I am not 100% certain, but I don't think you can use _*._tcp...... I think it has to be an actual port. In this case _25._tcp. ma....... -- John Allen KLaM ------------------------------------------ How many of you believe in telekinesis? Raise my hand...

Viele Grüße! i.A. Frank Fiene -- Frank Fiene IT-Security Manager VEKA Group Fon: +49 2526 29-6200 Fax: +49 2526 29-16-6200 mailto: ffiene@veka.com http://www.veka.com PGP-ID: 62112A51 PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51 Threema: VZK5NDWW VEKA AG Dieselstr. 8 48324 Sendenhorst Deutschland/Germany Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO), Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler, Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer HRB 8282 AG Münster/District Court of Münster

Am Mittwoch, 11. Februar 2015, 07:16:54 schrieb John:

On 2/11/2015 6:59 AM, Frank Fiene wrote:

...

Damned, don’t any short documentation. :-(

I’ve seen this on a website with a howto.

I will test with all smtp Ports. This should work for pop3s and imaps, too, shouldn’t it? What is about pop3 and imap with TLS, the same?

Frank

...

Am 11.02.2015 um 12:44 schrieb John :

That should have read - I am not 100% certain, but I don't think you can use _*._tcp...... I think it has to be an actual port. In this case _25._tcp. ma....... -- John Allen KLaM ------------------------------------------ How many of you believe in telekinesis? Raise my hand...

Viele Grüße! i.A. Frank Fiene -- Frank Fiene IT-Security Manager VEKA Group

Fon: +49 2526 29-6200 Fax: +49 2526 29-16-6200 mailto: ffiene@veka.com http://www.veka.com

PGP-ID: 62112A51 PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51 Threema: VZK5NDWW

VEKA AG Dieselstr. 8 48324 Sendenhorst Deutschland/Germany

Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO), Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler, Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer HRB 8282 AG Münster/District Court of Münster

This is my setup for smtp and submission -

_25._tcp.smtp.klam.ca. IN CNAME tlsa301a._dane.klam.ca. _587._tcp.smtp.klam.ca. IN CNAME tlsa301a._dane.klam.ca. tlsa301a._dane.klam.ca. IN TLSA ( 3 0 1 5bf12300255d

The credit for this goes to Viktor Dukhovni who advised me on how to set it up, without his input I would still be flailing around.

Yes. Carsten wrote a nice article in German. https://sys4.de/de/blog/2014/05/24/einen-tlsa-record-fuer-dane-mit-bind-9-pu... It is really time to translate that doc. Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

That DNS setup looks better, thx. For this time i will go for the CA-signed certificate.

Am 11.02.2015 um 17:55 schrieb Viktor Dukhovni :

On Wed, Feb 11, 2015 at 12:59:01PM +0100, Frank Fiene wrote:

...

This should work for pop3s and imaps, too, shouldn?t it? What is about pop3 and imap with TLS, the same?

For a shared key for multiple services that use distinct protocols:

_dane.mail.example.com. IN TLSA 3 1 1 <sha256 SPKI digest> _25._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _110._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _143._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _587._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _993._tcp.mail.example.com. IN CNAME _dane.mail.example.com.

This only makes sense if you need the certificate to be from a public CA trusted by some SMTP/IMAP/POP clients. For port 25, you should just go with a distinct self-signed key. Not sharing keys avoids simultaneously breaking all the services that share that key when a mistake is made during key rotation.

To generate the "3 1 1" SPKI digest:

printf '_dane.%s. IN TLSA 3 1 1 %s\n' \ mail.example.com \ $(openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256 -binary | hexdump -ve '/1 "%02x"')

* Never make the mistake of using a certificate digest with a "3 1 1" TLSA record or an SPKI (i.e. SubjectPublicKeyInfo or, in other words, the public key algorithm id, parameters and key bits) digest with a "3 0 1" TLSA record.

* Never make the mistake of installing a new key or certificate without following the TLSA record update process described in:

http://tools.ietf.org/html/draft-ietf-dane-ops-07#section-8.1 http://tools.ietf.org/html/draft-ietf-dane-ops-07#section-8.4

-- Viktor.

Viele Grüße! i.A. Frank Fiene -- Frank Fiene IT-Security Manager VEKA Group Fon: +49 2526 29-6200 Fax: +49 2526 29-16-6200 mailto: ffiene@veka.com http://www.veka.com PGP-ID: 62112A51 PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51 Threema: VZK5NDWW VEKA AG Dieselstr. 8 48324 Sendenhorst Deutschland/Germany Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO), Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler, Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer HRB 8282 AG Münster/District Court of Münster

On 2/11/2015 12:25 PM, Viktor Dukhovni wrote:

On Wed, Feb 11, 2015 at 06:20:32PM +0100, Frank Fiene wrote:

...

That DNS setup looks better, thx.

...

For a shared key for multiple services that use distinct protocols:

_dane.mail.example.com. IN TLSA 3 1 1 <sha256 SPKI digest> _25._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _110._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _143._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _587._tcp.mail.example.com. IN CNAME _dane.mail.example.com. _993._tcp.mail.example.com. IN CNAME _dane.mail.example.com. Note, I am not aware of any IMAP, POP or SMTP submission client software that uses DANE, so the records for ports other than 25 are largely pointless at present.

Just curious, you put the actual TLSA record first and then the CNAMEs. Any particular reason for the order? -- John Allen<br /> KLaM<br /> ------------------------------------------<br /> OK, so what is the speed of dark?

Thx Benny, it is working now! You are right!

Am 11.02.2015 um 18:45 schrieb Benny Pedersen :

On 11. feb. 2015 12.09.05 Frank Fiene wrote:

...

So what might be the problem now?

posttls-finger veka.com

gives here Verified TLS

Viele Grüße! i.A. Frank Fiene -- Frank Fiene IT-Security Manager VEKA Group Fon: +49 2526 29-6200 Fax: +49 2526 29-16-6200 mailto: ffiene@veka.com http://www.veka.com PGP-ID: 62112A51 PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51 Threema: VZK5NDWW VEKA AG Dieselstr. 8 48324 Sendenhorst Deutschland/Germany Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO), Dr. Andreas W. Hillebrand, Bonifatius Eichwald, Elke Hartleif, Dr. Werner Schuler, Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Ulrich Weimer HRB 8282 AG Münster/District Court of Münster