[dane] Implementing DANE

[Sirach Vassallo <[e-mail]>]

Dear Sir/madam,

My name is Sirach Vassallo and I am reading a B.Sc. Degree in Computer
Networks. As for my thesis, I am researching the DANE protocol. My research
includes the Limitations of PKI, DNSSEC and DANE as an alternative to PKI.

Part of my thesis includes the implementation of such protocol. However, I
am having a problem when it comes to TLSA validation by clients. Please, I
would like to ask some questions so that I may continue with my research. I
would really appreciate someone's help!


I have implemented DNSSEC for my domain: danetest.com. I am using BIND
9.9.5 on Ubuntu Desktop 12.04 LTS. I am using zonesigner from the
DNSSEC-Tools to sign my zone.

I have one primary DNS server and one Slave - both Ubuntu 12.04. I also
have another server (Windows Server 2012) running IIS 8 with 2 websites
verified.danetest.com and broken.danetest.com. I created self-signed
certificates for each of these websites and I am making use of SNI for
mapping these certificates to the correct hostname.

As for the client, I am using the DNSSEC/TLSA Validator extension on
Firefox (https://www.dnssec-validator.cz/) on Mac OS X 10.9.2.

I am attaching with this email the *db.danetest.com
<http://db.danetest.com>* and* db.danetest.com.signed* configuration files.

This is my TLSA record for verified.danetest.com

_443._tcp.verified.danetest.com. IN TLSA 3 0 1 (
baf3515d2695e25a2e4e850d909b4a446cdb7de3df2dfc116d36bb4afd94f99c )

I am generating the TLSA record by using this online tool:
https://www.huque.com/bin/gen_tlsa.
As the online tool requires a PEM format of the certificate, I am
converting the .pfx (created from IIs) to .pem using openSSL.

My question is, am I implementing the TLSA RR correctly? Since the client
extension is saying that the name verification is failing.

Should the Usage, Selector and Matching type fields be in number bits or
words as listed in the draft: draft-ietf-dane-ops-03 ?

Also, does the TLSA record needs to be inserted into the signed zone file?
or the normal unsigned conf file? I tried both, however, when using the IN
TLSA DANE-TA Cert SHA2-256 format instead of numbers, the zonesigner daemon
gave me an error saying that the format is not supported.

I would really appreciate your help. Thank you in advance, and hope to hear
from you soon.

Regards,


Sirach Vassallo

m. 00 356 99491210
e.  [e-mail]