7 ms·
In this case how is dns.google or cloudflare-dns.com resolved? Maybe in this case, because the author of the post only cares to check whether certain domains r
by jez 3y ago
In this case how is dns.google or cloudflare-dns.com resolved?
Maybe in this case, because the author of the post only cares to check whether certain domains resolve or not, having the DNS server be resolved by normal DNS not DNS over HTTPS is fine, and that in other cases you’d hardcode an IP like with normal DNS resolution?
- remram 3y agoThose are hardcoded. dns.google is 8.8.8.8 and cloudflare-dns.com is 1.1.1.1. You can replace the names with those IPs in the curl commands if you want, the certificates are valid for the IPs too.
- pyuser583 3y agoHow are certificates valid for IPs!?!
- PaoloBarbolini 3y agoCertificates can be issued for IPs too, CAs don't usually do it though.
- equinoxnemesis 3y agoSome CAs do it, for free even. ZeroSSL does iirc.
- dilyevsky 3y agoGoogle CA does too but only for max of 10 days
- themoonisachees 3y agoAs a CA, you may sign a certificate for anything. Public CAs don't do it for IPs for obvious reasons, but if you're cloudflare or Google, you can coax them with enough money and goodwill to sign a cert for your very expensive quad-single-digit ip, especially if you manage to motivate that request with the fact that the IP is a DNS resolver and can't be pointed at by a domain in the first place
- dilyevsky 3y agoSome public CAs do. Google Public CA issues certs for IP SANs with 10d validity. I think ZeroSSL and SSL.com do to but not ISRG last time I checked.
- themoonisachees 3y agoAs a CA, you may sign a certificate for anything. Public CAs don't do it for IPs for obvious reasons, but if you're cloudflare or Google, you can coax them with enough money and goodwill to sign a cert for your very expensive quad-single-digit ip, especially if you manage to motivate that request with the fact that the IP is a DNS resolver and can't be pointed at by a domain in the first place.
- arielcostas 3y agoGoogle actually runs their own CA "Google Trust Services", so they just create that certificate for themselves.
- hulitu 3y agoSo, in the end, Achmed was right. https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959
- tialaramex 3y agoThey're valid because the certificates include ipAddress Subject Alternative Names. PKIX (the RFC explaining how the X.500 system's X.509 certificates are to be repurposed for use on the Internet) explains several different names for Internet things, the "alternative names" and the most common you'll have seen is the dnsName, but ipAddress is also in there. As to how and when they're issued, section 3.2.2.5 of the Baseline Requirements explains how an Applicant can prove this is their IP address and so they're entitled to a certificate for that address. Note that the CA is entitled to choose which if any of the methods listed in 3.2.2.5 they will use, and it's not uncommon for the answer to be "None of them". https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-v2.0.1.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
- braiamp 3y ago> Note that the CA is entitled to choose which if any of the methods listed in 3.2.2.5 they will use, and it's not uncommon for the answer to be "None of them". That's not what the baseline says: > The CA SHALL confirm that prior to issuance, the CA has validated each IP Address listed in the Certificate using at least one of the methods specified in this section. You are confusing 3.2.2.5.4 with "no verification". It's done, just that the baseline trust that you are not an idiot and have some basis to confirm the ip address belongs to someone. And even that particular section has a sunset clause: > CAs SHALL NOT perform validations using this method after July 31, 2019. Completed validations using this method SHALL NOT be re‐used for certificate issuance after July 31, 2019. Any certificate issued prior to August 1, 2019 containing an IP Address that was validated using any method that was permitted under the prior version of this Section 3.2.2.5 MAY continue to be used without revalidation until such certificate naturally expires.
- tialaramex 3y agoAh, I thought about my choice of phrase "None of them" and I regretted it but was busy. I meant that it's not uncommon to just not issue such certificates, rather than you don't verify but you issue anyway, you don't verify because you always refuse to issue.
- AlexSW 3y agoHard-coded in what? Every DoH client?
- remram 3y agoWeb browsers usually. Chrome uses Google's, Firefox uses Cloudflare's. You can change it in the settings, but the reason it works out of the box is because it's shipped with an IP pre-set.
- Astraco 3y agoThey're not. I see queries to dns.google in my pihole all the time.
- navigate8310 3y agoYou usually provide an upstream all IP DNS to query the DoH provider which ultimately resolves whatever queries need resolution.