public nic.cz DoH service using lua-http (was: TLS misconfiguration on odvr.nic.cz (DoH))
21 Kvě
2019
21 Kvě
'19
9:33
(I'm including the mailing list so others can benefit from this
discussion as well since we had the proxy/no-proxy topic there before)
Vaclav Steiner wrote:
Our KRESd daemons are configured with lua-http module
for DoH, not anz reverse proxy.
Is this a temporary setup or what is the motivation behind not using any
HTTP frontend since knot-resolver developers actively recommend against
a "naked" kresd DoH endpoint without any reverse proxy?
And about list [3] we know. We want to be there :-)
Great to hear that.
kind regards,
Christoph
Issue [2] I’ll say guys from knot-resolver team.
Probably Firefox
doesn’t have problem with it.
a _fresh_ firefox 66.0.5 acutally has a problem with it:
"
Warning: Potential Security Risk Ahead
Firefox detected a potential security threat and did not continue to
odvr.nic.cz. If you visit this site, attackers could try to steal
information like your passwords, emails, or credit card details.
[...]
"
20. 5. 2019 v
19:36, Christoph wrote:
Hi Vaclav,
thanks for running a public DoH service [1].
Would be great if you could add your DoH server to the
public DNS resolver lists [3].
There is a TLS misconfiguration that results in a TLS error
because the certificate chain is incomplete [2].
Is this a kresd without any HTTP reverse proxy like nginx in front of it?
kind regards,
Christoph
[1] https://blog.nic.cz/2019/05/20/na-odvr-podporujeme-take-dns-over-https/
[2]
https://www.ssllabs.com/ssltest/analyze.html?d=odvr.nic.cz&hideResults=…
[3] https://github.com/curl/curl/wiki/DNS-over-HTTPS
https://github.com/DNSCrypt/dnscrypt-resolvers
21 Kvě
21 Kvě
10:12
On 5/21/19 9:33 AM, Christoph wrote:
I've been using DoH with 66.0.5 for several days at least (as the
primary browser), and even visiting the URL directly doesn't show
anything like that for me. I wonder what I'm doing differently. (BTW,
there's FF 67 now, too.) Still, we/I do know that not sending the
intermediary certificate isn't a correct behavior.
--Vladimir
Issue [2] I’ll
say guys from knot-resolver team. Probably Firefox
doesn’t have problem with it.
a _fresh_ firefox 66.0.5 acutally has a problem with it:
"
Warning: Potential Security Risk Ahead
Firefox detected a potential security threat and did not continue to
odvr.nic.cz. If you visit this site, attackers could try to steal
information like your passwords, emails, or credit card details.
[...]
"
10:18
Vladimír Čunát:
On 5/21/19 9:33 AM, Christoph wrote:
I've been using DoH with 66.0.5 for several days at least (as the
primary browser), and even visiting the URL directly doesn't show
anything like that for me. I wonder what I'm doing differently. (BTW,
there's FF 67 now, too.) Still, we/I do know that not sending the
intermediary certificate isn't a correct behavior.
Not all users will see that error because many will have the interm.
certificate already gotten from visiting others sites, but if you have
a fresh installation and visit that DoH endpoint you will get that error.
Issue [2]
I’ll say guys from knot-resolver team. Probably Firefox
doesn’t have problem with
it.
a _fresh_ firefox 66.0.5 acutally has a problem with it:
"
Warning: Potential Security Risk Ahead
Firefox detected a potential security threat and did not continue to
odvr.nic.cz. If you visit this site, attackers could try to steal
information like your passwords, emails, or credit card details.
[...]
"
10:27
On 5/21/19 10:18 AM, Christoph wrote:
Oh, right. Creating a fresh FF profile triggers it. I didn't know how
clients cope with the missing intermediaries (and still don't know much
about it). I'll look into why lua-http is doing this ATM.
--Vladimir
I've been
using DoH with 66.0.5 for several days at least (as the
primary browser), and even visiting the URL directly doesn't show
anything like that for me. I wonder what I'm doing differently. (BTW,
there's FF 67 now, too.) Still, we/I do know that not sending the
intermediary certificate isn't a correct behavior.
Not all users will see that
error because many will have the interm.
certificate already gotten from visiting others sites, but if you have
a fresh installation and visit that DoH endpoint you will get that error.
15:50
On 5/21/19 10:18 AM, Christoph wrote:
Not all users will see that error because many will
have the interm.
certificate already gotten from visiting others sites, but if you have
a fresh installation and visit that DoH endpoint you will get that error.
See https://gitlab.labs.nic.cz/knot/knot-resolver/merge_requests/819
16:26
Vladimír Čunát:
On 5/21/19 10:18 AM, Christoph wrote:
Thanks!
Can you confirm that this is limited to the DoH endpoint and does not
affect DoT?
thanks,
Christoph
Not all users will see that error because many
will have the interm.
certificate already gotten from visiting others sites, but if you have
a fresh installation and visit that DoH endpoint you will get that error.
See https://gitlab.labs.nic.cz/knot/knot-resolver/merge_requests/819
1803
days inactive
1803
days old
knot-resolver-users@lists.nic.cz
6 comments
2 participants
participants (2)
-
Christoph -
Vladimír Čunát