diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2017-12-20 21:14:06 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2017-12-20 22:03:23 +0000 |
| commit | 28646fa9c74b94722eadd7bc2d9c285245aded80 (patch) | |
| tree | 213e769b061562eb002237306a5da80b70c56d0c /test/dnszones-src | |
| parent | 944e8b37e80589aef9de20ea5fedd98bc0900307 (diff) | |
| download | exim4-28646fa9c74b94722eadd7bc2d9c285245aded80.tar.gz | |
DANE/GnuTLS: ignore traditional CA anchor validation in DANE-EE mode
Not quite right for a mixed TA+EE set of TLSA records, but better than always-enforcing
Diffstat (limited to 'test/dnszones-src')
| -rw-r--r-- | test/dnszones-src/db.example.com | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/test/dnszones-src/db.example.com b/test/dnszones-src/db.example.com index bc209ce5a..b00c87d13 100644 --- a/test/dnszones-src/db.example.com +++ b/test/dnszones-src/db.example.com @@ -22,4 +22,24 @@ example.com. NS exim.example.com. server1 A HOSTIPV4 +; DANE testing + +; a broken dane config where the name does not match in the cert, TA-mode, dane-requested +; NOTE: the server uses the example.net cert hence the mismatch +; +; openssl x509 -in aux-fixed/exim-ca/example.net/CA/CA.pem -fingerprint -sha256 -noout \ +; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]' +; +; +DNSSEC danebroken7 A 127.0.0.1 +DNSSEC _1225._tcp.danebroken7 TLSA 2 0 1 13646cc92c038932f57f752559271b893045eda39f765fc8369b05b2b9c3ac88 + +; the same, EE-mode +; +; openssl x509 -in aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem -noout -pubkey \ +; | openssl pkey -pubin -outform DER | openssl dgst -sha256 | awk '{print $2}' +; +DNSSEC danebroken8 A 127.0.0.1 +DNSSEC _1225._tcp.danebroken8 TLSA 3 1 1 3cc2a6efabd847663b92f827681fd8612fd4d001ea85057d79ea541fb2de02ac + ; End |