Re: Implementing DANE for qmail

On 9 April 2017 at 23:37, Erwin Hoffmann <[email protected]> wrote:
>
> You can briefly check, that this is on my agenda for s/qmail. The hard part is the validating DNS resolver.
> It is easy with DJBDNS. DNSSEC is be definition not secure but depends a X.509 system (not PKI) -- the one to avoid according to TLSA.
>
> Apart from that, PKI still needs to be supported.

Today was a good day. Spent some time demystifying DANE. It does not
look difficult. Here is small tutorial explaining how it works. I am
using TLSA RR records for ietf.org as an example

Get the mx record for ietf.org
---------------------------------------
$ host -tmx ietf.org
ietf.org mail is handled by 0 mail.ietf.org.

Get the TLSA Resource Record by appending _25._tcp. to the mx record
------------------------------------------
$ host -ttlsa _25._tcp.mail.ietf.org
_25._tcp.mail.ietf.org has TLSA record 3 1 1
0C72AC70B745AC19998811B131D662C9AC69DBDBE7CB23E5B514B566 64C5D3D6

The above shows the fingerprint
0C72AC70B745AC19998811B131D662C9AC69DBDBE7CB23E5B514B566 64C5D3D6


Capture the Certificate in a file test.pem
-----------------------------------------------------
$ echo QUIT | openssl s_client -starttls smtp -crlf -connect mail.ietf.org:25
(
echo -----BEGIN CERTIFICATE-----
sed -e '1,/^-----BEGIN CERTIFICATE-----/d' \
    -e '/^-----END CERTIFICATE-----/,$d' < /tmp/cert.tmp
echo -----END CERTIFICATE-----
) > test.pem

$ openssl x509 -pubkey -noout < test.pem | grep -v 'PUBLIC KEY' |
base64 -d | sha256sum
0c72ac70b745ac19998811b131d662c9ac69dbdbe7cb23e5b514b56664c5d3d6  -

Other than the output in lower case, it shows that the fingerprint for
the certificate matches with the fingerprint in the DNS TLSA record

Hope that the above example is useful for someone trying to understand DANE.
-- 
Regards Manvendra - http://www.indimail.org
GPG Pub Key
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC7CBC760014D250C