fedora-infrastructure

#3277 Request to add two TLSA DNS records
Closed: Fixed Opened by pwouters.

Closed: Fixed
Reopen Issue

I'm testing a new firefox plugin to use the upcoming TLSA record. These records are basically hashes of SSL certificates to pin certificates to a domain and thereby avoiding the issue of rogue CAs issuing certificates for your domain.

See https://tools.ietf.org/html/draft-ietf-dane-protocol-20

IANA has already assigned this draft DNS Resource Record type code 52

No software is currently using this record yet, so it is 100% safe to put in DNS. It is also not in the APEX itself, so it has 0 side effects.

Since the deployed DNS software does not yet know about the "TLSA" record type, we put the notation in the form of the "generic type". It works with all nameservers (bind, nsd, etc)

_443._tcp.fedoraproject.org. IN TYPE52 # 35 030001f4bf2ead76da47e2eb64d6bd80335b276574e8e62617908d4917f19e75920f22
_443._tcp.fedorahosted.org. IN TYPE52 # 35 030001d784eac9f9fe749baa99a541881273379b0ade49bef61827690d65cde83d8e90

(each record is one line, this form field might cause it to wrap)

Adding these records will allow us to start testing the TLSA firefox plugin and help IETF find any potential issues in deployments at an early stage.

I don't see any harm in adding these, so +1 here...

you'll need 1 more approval to break the current freeze to add it now.

OK I would like to see the field in a text file to make sure we had all the proper back slashes and such the ticket would remove.

Second question, do all versions of bind (RHEL-5/RHEL-6) accept this field? I have run into issues where fields like this caused bind to error out.

Thanks.

http://tools.ietf.org/html/rfc3597 for the Generic DNS record format dates back to 2003. It is supported by bind8 and up, and nsd-2.1 and up. see http://tools.ietf.org/html/draft-ietf-dnsext-interop3597-02

I've put them in a text file at: http://people.redhat.com/pwouters/tlsa.txt

Indeed, the blackslash ends up as text in the zonefile.

Commited. Enjoy.

Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.