= bug description =

The TLSA record for fedoraproject.org does not match any of the certificates in certchain of https://fedoraproject.org.

= bug analysis =

Current TLSA record looks like this:

{{{
dig +dnssec -t type52 _443._tcp.fedoraproject.org

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.10.rc1.el6_3.6 <<>> +dnssec -t type52 _443._tcp.fedoraproject.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58381
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;_443._tcp.fedoraproject.org. IN TYPE52

;; ANSWER SECTION:
_443._tcp.fedoraproject.org. 300 IN TYPE52 # 35 030001F4BF2EAD76DA47E2EB64D6BD80335B276574E8E62617908D49 17F19E75920F22
_443._tcp.fedoraproject.org. 300 IN RRSIG TYPE52 5 4 300 20130215221014 20130116221014 7725 fedoraproject.org. EUwZokh6uFjN9NdpcBVsxDqW/cuCiC8mulM5X+3Y+QSAdaEY5StZdxk1 JV51o/RIpOMf+WenTZ4hYFd2K6olODu6zAFLlCYc2Ke/eAF1X6GBvddZ es87eelG11UmPCLkxjar9C8CukGZgYGDsdi4oWgZsJ15pbXU5jyQE+Bf d6k=
}}}

Currently the TLSA record would match an end-entity server certificate with SHA256 hash (see https://tools.ietf.org/html/rfc6698#section-2):
F4BF2EAD76DA47E2EB64D6BD80335B276574E8E62617908D4917F19E75920F22

However, current end-entity certificate of https://fedoraproject.org has SHA256 hash:
8F:0F:23:74:F2:FD:B5:7E:F0:DD:CC:27:04:A1:51:9B:A7:75:7A:ED:34:14:5D:C8:A8:32:36:B5:C1:6A:F0:DB

(e.g. check via openssl s_client -connect fedoraproject.org:443 -servername fedoraproject.org -tls1 < /dev/null | openssl x509 -noout -fingerprint -sha256)

= fix recommendation =

Options:

1. Update hash in the TLSA record to match the HTTPS certificate, i.e. the record would look like:
2. _443._tcp.fedoraproject.org. 300 IN TYPE52 \# 35 0300018F0F2374F2FDB57EF0DDCC2704A1519BA7757AED34145DC8A83236B5C16AF0DB
3. If you plan on using the same issuing GeoTrust CA in future, you might want to use certificate usage 0 and pin to a CA certificate (pins the GeoTrust intermediate by SHA256 hash):
4. _443._tcp.fedoraproject.org. IN TYPE52 \# 35 000001d4c4c99819f3a5f2c6261c9444c62a8b263b39bc6acce35cdcabe272d5037fb2
5. Alternatively, you can pin to hash of public key of the GeoTrust CA certificate (SHA256 hash of SPKI)
6. _443._tcp.fedoraproject.org. IN TYPE52 \# 35 000101fc7b1eafe778adf9a5b28c71d7f3bdec51a7b1d615c6c64e183c26d267de3038

Possibly useful tools (both alpha though):

Swede - https://github.com/pieterlexis/swede
* ./swede create --usage 0 --selector 1 fedoraproject.org

DANE Patrol for testing the TLSA record - https://labs.nic.cz/page/1207/dane-patrol/ (click english on top if you don't get EN version)