4 ms·
'[RFC2818] defines how HTTPS verifies the DoH server's identity.' that RFC is TLS over HTTP How do you resolve the IP address of your DoH server? Is the answer
by sytse 8y ago
'[RFC2818] defines how HTTPS verifies the DoH server's identity.' that RFC is TLS over HTTP
How do you resolve the IP address of your DoH server? Is the answer to just use an IP address? In that case does it have a certificate for the IP addresses instead of for a FQDN?
- Aissen 8y agoYou use a name by default, and if you want to bypass resolution with a system DNS, you hardcode it's IP alongside the name. For example, in firefox: network.trr.bootstrapAddress - (default: none) by setting this field to the IP address of the host name used in "network.trr.uri", you can bypass using the system native resolver for it. This avoids that initial (native) name resolve for the host name mentioned in the network.trr.uri pref. https://daniel.haxx.se/blog/2018/06/03/inside-firefoxs-doh-engine/ https://daniel.haxx.se/blog/2018/06/03/inside-firefoxs-doh-e...
- callahad 8y ago> In that case does it have a certificate for the IP addresses instead of for a FQDN? It can be both: If you look at https://1.1.1.1/ https://1.1.1.1/, the certificate is issued for *.cloudflare-dns.com, but it also contains the alternative names 1.1.1.1 and 1.0.0.1.
- jedisct1 8y agoThe bootstrap IPs, or the IPs themselves, can be part of the DNS stamp: https://dnscrypt.info/stamps-specifications https://dnscrypt.info/stamps-specifications The name used to check the certificate and the URL are also distinct. For example, look at the stamp for Cloudflare: https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v2/public-resolvers.md#cloudflare https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v... It defines https://1.0.0.1/dns-query https://1.0.0.1/dns-query for the URL, but dns.cloudflare.com for the certificate name.