IETF Logo Mail Archive

Re: [dane] Client tool to check DANE records (for monitoring)

Viktor Dukhovni <ietf-dane@dukhovni.org> Fri, 08 August 2014 15:30 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D5621B2B82 for <dane@ietfa.amsl.com>; Fri, 8 Aug 2014 08:30:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZaGrR-pPwKoc for <dane@ietfa.amsl.com>; Fri, 8 Aug 2014 08:30:28 -0700 (PDT)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [38.117.134.19]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF8FB1B2BA9 for <dane@ietf.org>; Fri, 8 Aug 2014 08:30:27 -0700 (PDT)
Received: by mournblade.imrryr.org (Postfix, from userid 1034) id 9DE7A2AB29E; Fri, 8 Aug 2014 15:30:26 +0000 (UTC)
Date: Fri, 08 Aug 2014 15:30:26 +0000
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
To: dane@ietf.org
Message-ID: <20140808153026.GW14392@mournblade.imrryr.org>
References: <20140808134233.GA20325@danton.fire-world.de> <86fvh7m49g.fsf@strotmann.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <86fvh7m49g.fsf@strotmann.de>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: http://mailarchive.ietf.org/arch/msg/dane/emdswaRh0YlGu8T5p4TCdh1qvZE
Subject: Re: [dane] Client tool to check DANE records (for monitoring)
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: dane@ietf.org
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Aug 2014 15:30:38 -0000

On Fri, Aug 08, 2014 at 04:42:51PM +0200, Carsten Strotmann wrote:

> ldns-dane from the (recent version of the) ldns tool (by NLnetLabs):
> 
> % ldns-dane verify strotmann.de 443
> 91.190.147.212 dane-validated successfully
> 2001:470:1f08:f1d::2 dane-validated successfully

For SMTP, the Postfix source distribution as of 2.11 or later, includes
posttls-finger:

	http://www.postfix.org/posttls-finger.1.html

Concise:

    $ posttls-finger -c -L summary strotmann.de
    posttls-finger: Verified TLS connection established to mail.strotmann.de[91.190.147.212]:25: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)

More verbose:

    $ posttls-finger strotmann.de
    posttls-finger: using DANE RR: _25._tcp.mail.strotmann.de IN TLSA 3 0 1 2C:DD:A7:3A:FD:1D:6D:82:C7:E9:EB:8F:D4:37:C4:88:62:73:E5:2F:9A:E3:0A:BC:16:89:93:9C:5F:52:20:91
    posttls-finger: using DANE RR: _25._tcp.mail.strotmann.de IN TLSA 3 0 1 DD:8B:57:EE:38:AF:6C:7E:70:DA:A4:1D:A8:0A:6A:17:1D:82:18:58:48:AA:7C:7A:A8:9D:31:97:BF:11:D9:0F
    posttls-finger: Connected to mail.strotmann.de[91.190.147.212]:25
    posttls-finger: < 220 csgate3.strotmann.de ESMTP Postfix
    posttls-finger: > EHLO amnesiac.example
    posttls-finger: < 250-csgate3.strotmann.de
    posttls-finger: < 250-PIPELINING
    posttls-finger: < 250-SIZE 50000000
    posttls-finger: < 250-VRFY
    posttls-finger: < 250-ETRN
    posttls-finger: < 250-STARTTLS
    posttls-finger: < 250-AUTH PLAIN LOGIN
    posttls-finger: < 250-AUTH=PLAIN LOGIN
    posttls-finger: < 250-ENHANCEDSTATUSCODES
    posttls-finger: < 250-8BITMIME
    posttls-finger: < 250 DSN
    posttls-finger: > STARTTLS
    posttls-finger: < 220 2.0.0 Ready to start TLS
    posttls-finger: mail.strotmann.de[91.190.147.212]:25: depth=0 matched end entity certificate sha256 digest 2C:DD:A7:3A:FD:1D:6D:82:C7:E9:EB:8F:D4:37:C4:88:62:73:E5:2F:9A:E3:0A:BC:16:89:93:9C:5F:52:20:91
    posttls-finger: mail.strotmann.de[91.190.147.212]:25: Matched subjectAltName: mail.strotmann.de
    posttls-finger: mail.strotmann.de[91.190.147.212]:25: subjectAltName: imap.strotmann.de
    posttls-finger: mail.strotmann.de[91.190.147.212]:25: subjectAltName: smtp.strotmann.de
    posttls-finger: mail.strotmann.de[91.190.147.212]:25 CommonName mail.strotmann.de
    posttls-finger: mail.strotmann.de[91.190.147.212]:25: subject_CN=mail.strotmann.de, issuer_CN=CA Cert Signing Authority, fingerprint=B0:2C:D6:53:A4:CD:5A:85:EE:12:BB:4E:E7:36:4F:6E:D6:5A:29:E9, pkey_fingerprint=BF:AE:74:62:57:F2:F0:D8:CD:40:3E:3C:D9:64:13:40:B7:8D:C6:2F
    posttls-finger: Verified TLS connection established to mail.strotmann.de[91.190.147.212]:25: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
    posttls-finger: > EHLO amnesiac.example
    posttls-finger: < 250-csgate3.strotmann.de
    posttls-finger: < 250-PIPELINING
    posttls-finger: < 250-SIZE 50000000
    posttls-finger: < 250-VRFY
    posttls-finger: < 250-ETRN
    posttls-finger: < 250-AUTH PLAIN LOGIN
    posttls-finger: < 250-AUTH=PLAIN LOGIN
    posttls-finger: < 250-ENHANCEDSTATUSCODES
    posttls-finger: < 250-8BITMIME
    posttls-finger: < 250 DSN
    posttls-finger: > QUIT
    posttls-finger: < 221 2.0.0 Bye

-- 
	Viktor.

v2.46.0 | Report a Bug | By Email | System Status