<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:Consolas;}
span.E-MailFormatvorlage22
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt">Hi Willem!<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I am not sure either what would be the best approach. Knot’s PIN approach is great for private installations, but not for general TLS applications where you do not know the other party but want to know a trusted
name (confirmed by some well known CA). So far I like Bind’s approach most, where the TLS configuration is similar to standard webservers where you can use either OS installed certificates or provide a list of trusted CA certs manually. Maybe we should wait
for more XoT deployments and more feedback from admins.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Anyway, IMHO all 3 implementations (Knot, Bind, NSD) lacks logging of TLS parameters and helpful error messages when TLS handshakes fail.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">For example, NSD’s “axfr for … from …. refused tls-auth-xfr-only” as only error log is not very helpful when I try to understand why the connection fails. For example NSD could add some more info if connection
fails, like: Did NSD as primary requested a client cert from the secondary name server? If yes, did the secondary provided a certificate? If yes, what is the host name that was searched in the certificate name? Was it found or not? Why was the client certificate
not accepted? Or was everything with the client certificate but the configured policy forbids zone transfer?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Klaus<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="DE-AT" style="font-size:11.0pt">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-AT" style="font-size:11.0pt">Klaus Darilion, Head of Operations<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-AT" style="font-size:11.0pt">nic.at GmbH, Jakob-Haringer-Straße 8/V<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-AT" style="font-size:11.0pt">5020 Salzburg, Austria<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="DE" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> nsd-users <nsd-users-bounces@lists.nlnetlabs.nl>
<b>On Behalf Of </b>Willem Toorop via nsd-users<br>
<b>Sent:</b> Tuesday, March 18, 2025 4:39 PM<br>
<b>To:</b> nsd-users@lists.nlnetlabs.nl<br>
<b>Subject:</b> Re: [nsd-users] Can XoT use self-signed certificates?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Op 18-03-2025 om 14:14 schreef Klaus Darilion via nsd-users:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt">Answering myself (untested yet): It seems that ‘<a href="tls-cert-bundle:’">tls-cert-bundle:’</a> may be the solution to manually specify trust anchors. Frankly, this is a ‘<a href="server:’">server:’</a>
option but I would have expected it under the tls-auth: section to be configurable per tls-context.</span><o:p></o:p></p>
</blockquote>
<p>We could modify that of course, but personally I also feel for the pin authentication that Knot-dns employs. Would that work for you?<o:p></o:p></p>
<p>Regards,<o:p></o:p></p>
<p>-- Willem<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Regards</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Klaus</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="DE" style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> nsd-users
<a href="mailto:nsd-users-bounces@lists.nlnetlabs.nl"><nsd-users-bounces@lists.nlnetlabs.nl></a>
<b>On Behalf Of </b>Klaus Darilion via nsd-users<br>
<b>Sent:</b> Monday, March 17, 2025 2:32 PM<br>
<b>To:</b> <a href="mailto:nsd-users@lists.nlnetlabs.nl">nsd-users@lists.nlnetlabs.nl</a><br>
<b>Subject:</b> [nsd-users] Can XoT use self-signed certificates?</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="color:black">Hi!</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">I am testing XoT with NSD as secondary.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">As far as I see, for certificate validation always the OS installed CA certificates are used. (/etc/ca-certificates.conf in Ubuntu)</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Is it possible to use self signed certificates and manually configure a trust-anchor (e.g. ca-file option in many other TLS supported software)?</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Is it possbile to use opportunistic/ephemeral TLS as supported by Bind?</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Thanks</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Klaus</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>nsd-users mailing list<o:p></o:p></pre>
<pre><a href="mailto:nsd-users@lists.nlnetlabs.nl">nsd-users@lists.nlnetlabs.nl</a><o:p></o:p></pre>
<pre><a href="https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users">https://lists.nlnetlabs.nl/mailman/listinfo/nsd-users</a><o:p></o:p></pre>
</blockquote>
</div>
</div>
</body>
</html>