Subject: [dane] DANE test sites

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Wed, 3 Oct 2012 11:11:08 +0200

Are there any test or even real world https sites that support DANE?

regards,
Nikos

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 3 Oct 2012 11:27:22 +0200

On Wed, Oct 03, 2012 at 11:11:08AM +0200,
 Nikos Mavrogiannopoulos <[email-masked]> wrote 

> Are there any test or even real world https sites that support DANE?

A test one is https://dane.rd.nic.fr/

If you want a broken one, use https://dane-broken.rd.nic.fr/

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Wed, 3 Oct 2012 11:58:04 +0200

On Wed, Oct 3, 2012 at 11:27 AM, Stephane Bortzmeyer <[email-masked]> wrote:

>> My own domain has a TLSA record: https://forfun.net

Thank you!

Nikos

---

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Wed, 03 Oct 2012 14:18:32 +0200

Hi Nikos,

On 10/03/2012 11:58 AM, Nikos Mavrogiannopoulos wrote:
>>> Are there any test or even real world https sites that support
>>> DANE? My own domain has a TLSA record: https://forfun.net
>> A test one is https://dane.rd.nic.fr/ If you want a broken one,
>> use https://dane-broken.rd.nic.fr/

www.nlnetlabs.nl has dane.

Best regards,
   Wouter

---

From: Paul Wouters <[email-masked]>
Date: Wed, 3 Oct 2012 10:34:33 -0400 (EDT)

> Are there any test or even real world https sites that support DANE?

fedoraproject.org
torproject.org
hacklab.to
nohats.ca
rogue.nohats.ca (though that ssl cert should get renewed, just didn't
                  want to pay $250)

Paul

---

From: SM <[email-masked]>
Date: Wed, 03 Oct 2012 07:32:15 -0700

Hi Stephane,
>A test one is https://dane.rd.nic.fr/

The certificate is only valid for www.dane.rd.nic.fr.  See DNS reply below:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57147
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;www.dane.rd.nic.fr.            IN      A

;; AUTHORITY SECTION:
dane.rd.nic.fr.         3600    IN      NS      dane.rd.nic.fr.
dane.rd.nic.fr.         3600    IN      NS      ns3.nic.fr.

Regards,
-sm

---

From: James Cloos <[email-masked]>
Date: Wed, 03 Oct 2012 16:10:02 -0400

>>>>> "NM" == Nikos Mavrogiannopoulos <[email-masked]> writes:

NM> Are there any test or even real world https sites that support DANE?

https://jhcloos.com/  (also supports spdy).

Outside of http, my MXs have TLSA RRs, too.

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 1024D/ED7DAEA6

---

From: Warren Kumari <[email-masked]>
Date: Wed, 3 Oct 2012 18:22:43 -0400

> https://jhcloos.com/  (also supports spdy).

www.kumari.net…

Unfortunately the CN is *.kumari.net, and swede verify complains that that:
WARNING: Name on the certificate (Subject: /serialNumber=20Vw66yC802bGJ8IiSaq/ICmQRp2wah0/C=US/O=*.kumari.net/OU=GT03082892/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=*.kumari.net, SubjectAltName: DNS:*.kumari.net, DNS:kumari.net) doesn't match requested hostname (www.kumari.net).

I started writing a patch  for swede to deal with wildcards, but then got sidetracked :-P

W

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 3 Oct 2012 18:52:50 -0400

> I started writing a patch  for swede to deal with wildcards, but then got sidetracked :-P

Seems to me like the patch should just comment out the whole part that checks the CN, since that's an application-layer issue, not a DANE issue.  Doesn't seem *that* harmful to throw a warning, though.

---

From: sandoche BALAKRICHENAN <[email-masked]>
Date: Thu, 04 Oct 2012 11:37:55 +0200

Thanks for pointing out. Now it has been corrected.

Sandoche.

---

From: Dan York <[email-masked]>
Date: Thu, 4 Oct 2012 09:34:31 -0400

> Are there any test or even real world https sites that support DANE?

So that this excellent list of test sites can be easily found for others, I've added a page to our Deploy360 site listing out all the sites mentioned so far:

http://www.internetsociety.org/deploy360/resources/dane-test-sites/

If you have other sites publishing TLSA records right now that you would like me to list, please contact me and I'll be glad to add it.    In particular it would be interesting to list other invalid/broken sites that people could use for testing.

It also strikes me that it might be interesting to break the list of test sites out into:

  - HTTP - Valid TLSA Record with Valid CA-Certified TLS Certificate
  - HTTP - Valid TLSA Record with Valid Self-Signed TLS Certificate

I'm also wondering about this case:

  - HTTP - Valid TLSA Record with Invalid CA-Certified TLS Certificate (ex. Paul's site where the CA-cert hasn't been renewed)

Which of course also brings up:

  - HTTP - Valid TLSA Record with Invalid Self-Signed TLS Certificate 

It seems to be that it would be useful if test sites were out there for all those cases.  Are there other test cases for which sites would be useful?

Also, if anyone has test sites using protocols other than HTTP I would be glad to add those, too.

Regards,
Dan

-- 
Dan York  [email-masked]
http://www.danyork.me/   skype:danyork
Phone: +1-802-735-1624
Twitter - http://twitter.com/danyork

---

From: Tony Finch <[email-masked]>
Date: Thu, 4 Oct 2012 16:06:33 +0100

> Outside of http, my MXs have TLSA RRs, too.

Nice :-)

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first.
Rough, becoming slight or moderate. Showers, rain at first. Moderate or good,
occasionally poor at first.

---

From: Dan York <[email-masked]>
Date: Thu, 4 Oct 2012 11:57:21 -0400

FYI, I've now updated this page of DANE test sites to add a couple of more that were sent to me and to break it out according to the different types of sites:

I put the sites in different categories based on what I could see using my browser.  Please feel free to let me know if you don't think I categorized your site correctly.  I'm also glad to keep adding more sites, too, if you let me know about them.

Regards,
Dan

P.S. And yes, I'll work on getting the Deploy360 site (well, the larger ISOC site of which Deploy360 is a part) to have a TLSA record, too.  This was part of why I was asking about tutorials to help people understand how to publish TLSA records.  I don't control the DNS or the web server for the site, and so I need a simple step-by-step process I can forward to the IT team responsible for the site.

---

From: Warren Kumari <[email-masked]>
Date: Thu, 4 Oct 2012 12:21:23 -0400

On Wednesday, October 3, 2012 at 6:52 PM, Richard Barnes wrote:  
> > On Oct 3, 2012, at 4:10 PM, James Cloos <[email-masked] (mailto:[email-masked])> wrote:
> >  
> > > > > > > > "NM" == Nikos Mavrogiannopoulos <[email-masked] (mailto:[email-masked])> writes:
> > >  
> > www.kumari.net (http://www.kumari.net)…
> >  
> > Unfortunately the CN is *.kumari.net (http://kumari.net), and swede verify complains that that:
> > WARNING: Name on the certificate (Subject: /serialNumber=20Vw66yC802bGJ8IiSaq/ICmQRp2wah0/C=US/O=*.kumari.net/OU=GT03082892/OU=See www.rapidssl.com/resources/cps (http://www.rapidssl.com/resources/cps) (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=*.kumari.net, SubjectAltName: DNS:*.kumari.net, DNS:kumari.net) doesn't match requested hostname (www.kumari.net (http://www.kumari.net)).
> >  
> >  
[ Apologies if this mail is formatted oddly, testing a new MUA ]  

Yeah, thats what I did (well, actually I just made it return True if the specific match doesn't work. I also commented out the AAAA checks. Sometime I plan to go back and make it cleaner…

Output:

Received the following record for name _443._tcp.www.kumari.net.:
Usage: 1 (End-Entity Constraint + chain to CA)
Selector: 0 (Certificate)
Matching Type: 1 (SHA-256)
Certificate for Association: 4209129179ca542ed5df797e84d4de4d4cc8689b8aba579fda3f8844ec144dd5
This record is valid (well-formed).
Attempting to verify the record with the TLS service...
Got the following IP: 198.186.192.250
WARNING: Name on the certificate (Subject: /serialNumber=20Vw66yC802bGJ8IiSaq/ICmQRp2wah0/C=US/O=*.kumari.net/OU=GT03082892/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=*.kumari.net, SubjectAltName: DNS:*.kumari.net, DNS:kumari.net) doesn't match requested hostname (www.kumari.net).
SUCCESS (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record and chains to a valid CA certificate
The matched certificate has Subject: /serialNumber=20Vw66yC802bGJ8IiSaq/ICmQRp2wah0/C=US/O=*.kumari.net/OU=GT03082892/OU=See www.rapidssl.com/resources/cps (c)11/OU=Domain Control Validated - RapidSSL(R)/CN=*.kumari.net

Patch:
--- swede.orig 2012-10-02 17:17:22.358961230 -0400
+++ swede 2012-10-04 12:11:11.300255130 -0400
@@ -254,7 +254,9 @@
else:
if with_msg:
print 'WARNING: Name on the certificate (Subject: %s, SubjectAltName: %s) doesn\'t match requested hostname (%s).' % (str(cert.get_subject()), altnames_on_cert, hostname)
- return False
+ # return False
+ # WK : deal with wildcards. Need to make this less icky...
+ return True

class TLSARecord:
"""When instanciated, this class contains all the fields of a TLSA record.
@@ -465,7 +467,8 @@

if not args.quiet:
print 'Attempting to verify the record with the TLS service...'
- addresses = getA(args.host, secure=secure) + getAAAA(args.host, secure=secure)
+# addresses = getA(args.host, secure=secure) + getAAAA(args.host, secure=secure)
+ addresses = getA(args.host, secure=secure)
for address in addresses:
if not args.quiet:
print 'Got the following IP: %s' % str(address)
@@ -601,7 +604,8 @@
sys.stdout.write('Port %s not numerical or within correct range (1 <= port <= 65535), try again (hit enter for default 443): ' % user_input)
# Get the address records for the host
try:
- addresses = getA(args.host, secure=secure) + getAAAA(args.host, secure=secure)
+# addresses = getA(args.host, secure=secure) + getAAAA(args.host, secure=secure)
+ addresses = getA(args.host, secure=secure)
except InsecureLookupException, e:
print >> sys.stderr, str(e)
sys.exit(1)

---

From: "Larson, Matt" <[email-masked]>
Date: Tue, 9 Oct 2012 20:24:57 +0000

> Are there any test or even real world https sites that support DANE?

Please see http://dane.verisignlabs.com for various kinds of working and broken examples.  (Thanks to Duane Wessels, who also gave the world http://test.dnssec-or-not.net  :-) )

Matt

---

From: Warren Kumari <[email-masked]>
Date: Wed, 10 Oct 2012 17:22:46 -0400

Whoohoo!

Thanks DuANE.

W