Re: [dane] NIST DANE Tester Announcement

Stephen Nightingale <night@nist.gov> Thu, 07 November 2013 15:04 UTC

Return-Path: <stephen.nightingale@nist.gov>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81BB221E8258 for <dane@ietfa.amsl.com>; Thu, 7 Nov 2013 07:04:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.134
X-Spam-Level:
X-Spam-Status: No, score=-6.134 tagged_above=-999 required=5 tests=[AWL=0.465, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 29KJYCgydCxU for <dane@ietfa.amsl.com>; Thu, 7 Nov 2013 07:04:43 -0800 (PST)
Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 026A121E824B for <dane@ietf.org>; Thu, 7 Nov 2013 07:04:31 -0800 (PST)
Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.3.158.1; Thu, 7 Nov 2013 10:04:10 -0500
Received: from postmark.nist.gov (129.6.16.94) by WSXGHUB1.xchange.nist.gov (129.6.18.96) with Microsoft SMTP Server (TLS) id 8.3.298.1; Thu, 7 Nov 2013 10:04:08 -0500
Received: from [127.0.0.1] (31-140.antd.nist.gov [129.6.140.31]) by postmark.nist.gov (8.13.8/8.13.1) with ESMTP id rA7F403w002871 for <dane@ietf.org>; Thu, 7 Nov 2013 10:04:02 -0500
Message-ID: <527BABCC.7060308@nist.gov>
Date: Thu, 07 Nov 2013 10:03:40 -0500
From: Stephen Nightingale <night@nist.gov>
Organization: NIST
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8
MIME-Version: 1.0
To: dane@ietf.org
References: <527A753A.4040800@nist.gov> <20131106221442.GB5561@mournblade.imrryr.org> <527AD0D7.4030000@sidn.nl>
In-Reply-To: <527AD0D7.4030000@sidn.nl>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-NIST-MailScanner-Information:
Subject: Re: [dane] NIST DANE Tester Announcement
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: night@nist.gov
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Nov 2013 15:04:48 -0000

On 11/6/2013 6:29 PM, Marco Davids (SIDN) wrote:
> For those of you who prefer a somewhat more simple approach, there is 
> still: 
> https://check.sidnlabs.nl/dane/

This is a potentially useful adjunct for clients that don't do DANE 
validation.
BUT
This is the answer for NIST.gov:
Warning! No TLSA records for _443._tcp.inside.nist.gov. were found.
PKIX validation without DANE will be performed.
129.6.13.244 dane-validated successfully

Maybe you should say that the certificate PKIX validated, rather than 
saying that DANE validated successfully, since there is no TLSA record?

Stephen.