3 ms·
Here's the stubby config if anyone is interested: # Google - address_data: 8.8.8.8 tls_auth_name: "dns.google" tls_pubkey_pinset: - digest: "
by _nhynes_ 8y ago
Here's the stubby config if anyone is interested:
# Google
- address_data: 8.8.8.8
tls_auth_name: "dns.google"
tls_pubkey_pinset:
- digest: "sha256"
value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE=
- address_data: 8.8.4.4
tls_auth_name: "dns.google"
tls_pubkey_pinset:
- digest: "sha256"
value: nxmRHK4Oq08HNWWYZwakeCHmiKvsDsEaBPS3blQ+nSE=
where the pinset is generated using
openssl s_client -connect '8.8.8.8:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
source: https://blog.because-security.com/t/use-cloudflare-dns-with-tls-on-mac-os-x-gui-and-cli-way/315 https://blog.because-security.com/t/use-cloudflare-dns-with-...
- FrederickZh 8y agoGot no idea why but it seems actually two different certificates are used? Base64 digest of the other one is A8J84S7EER8rZJ/IQ6MsYW7heNY939jWL7IpOLrj+VM= And I wonder whether we should actually add the digests into stubby configs? One of the certificates expires in February and other one expires in March. Does it mean that we have to update the configs then?