3 ms·
I don't use Docker; I run dnscrypt-wrapper on my own server and clients connect to it using your dnscrypt-proxy software. Please pardon my ignorance, but how wo
by oil25 7y ago
I don't use Docker; I run dnscrypt-wrapper on my own server and clients connect to it using your dnscrypt-proxy software. Please pardon my ignorance, but how would you propose automating key rotation in this circumstance (assuming the key is "sdns://...")? Right now it's an involved process of interactively logging in weekly to generate the keys and copy-paste the value into the dnscrypt-proxy.toml configuration file - for each client! I'm probably missing something obvious. Thank you for your work and reply.
- jedisct1 7y agoThe DNS stamp (the sdns: address that clients use) doesn't have to change. That wouldn't be very practical :) See the documentation of dnscrypt-wrapper: https://github.com/cofyc/dnscrypt-wrapper https://github.com/cofyc/dnscrypt-wrapper Two kind of keys are involved: a long-term key ("provider key", used for signatures), and ephemeral keys (used for encryption, and signed by the long-term key). Clients only need the public long-term key, which is included in the DNS stamp. What you are rotating is just the ephemeral key pair (`--gen-crypt-keypair`). This is similar to what happens to TLS certificates: you can update the certificate for a domain name as frequently as needed. But you don't need to install a new version of the operating system every time somebody adds or changes a certificate for their website. dnscrypt-wrapper can serve multiple certificates simultaneously, so you can serve the next certificate even if the current one hasn't expired yet.