IETF Logo Mail Archive

Re: [dane] Two additions to draft-york-dane-deployment-observations-00

Melinda Shore <melinda.shore@gmail.com> Sun, 09 November 2014 04:07 UTC

Return-Path: <melinda.shore@gmail.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E8841A034F for <dane@ietfa.amsl.com>; Sat, 8 Nov 2014 20:07:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.486
X-Spam-Level:
X-Spam-Status: No, score=-0.486 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001, URIBL_RHS_DOB=1.514] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DjAbSQJBQRFy for <dane@ietfa.amsl.com>; Sat, 8 Nov 2014 20:07:15 -0800 (PST)
Received: from mail-pd0-x22c.google.com (mail-pd0-x22c.google.com [IPv6:2607:f8b0:400e:c02::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB0611A0278 for <dane@ietf.org>; Sat, 8 Nov 2014 20:07:14 -0800 (PST)
Received: by mail-pd0-f172.google.com with SMTP id r10so5704983pdi.17 for <dane@ietf.org>; Sat, 08 Nov 2014 20:07:14 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=j8LtugJsb+wvxwz1oYh063GIvJwTwa7S8Lq8bQm4kjQ=; b=Hx+4GcG8csEi3kTW7fnEY6i+62KClbdaDuvwKzFFXipAw0g0ZDfb6GolV2s9jqhMzo p5IZA3zjqjdF0S2JS5vmO0RdbHoXyR8wE69Xf4JpfYFceCuuDVGCHAe/uDBtbxlPq+d3 1r07vKsVRNv9xhQzqX7mG5Ru8/2DADtCClKeekeFcNnaSwEcY05SMNWWJ6uz/4ffPupG RCVkchZvK4L38G1WtAV6kCsJpqAbCuu1X0ea9hCpPDRAPc8tVJdPwh1IR7Sp6xMlGP4j 7n2AGaKYHHShutz9ChWKnAKBXiiW2zQRwxGZ80gs/mJSmSNKAr/Wn79YSLDapY9J1JPJ TGOw==
X-Received: by 10.66.160.74 with SMTP id xi10mr2771746pab.72.1415506034069; Sat, 08 Nov 2014 20:07:14 -0800 (PST)
Received: from spandex.local (69-161-3-100-rb2.sol.dsl.dynamic.acsalaska.net. [69.161.3.100]) by mx.google.com with ESMTPSA id u1sm12792272pdj.29.2014.11.08.20.07.12 for <dane@ietf.org> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 08 Nov 2014 20:07:12 -0800 (PST)
Message-ID: <545EE86E.9050007@gmail.com>
Date: Sat, 08 Nov 2014 19:07:10 -0900
From: Melinda Shore <melinda.shore@gmail.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: dane@ietf.org
References: <20141107232915.GA31913@laperouse.bortzmeyer.org> <6DB8CC95-E47A-4C0B-BC0B-7D9A4F8F65B5@edvina.net> <20141109035925.GA20946@laperouse.bortzmeyer.org>
In-Reply-To: <20141109035925.GA20946@laperouse.bortzmeyer.org>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/dane/y5YJvIAEYQ8pB7VJhHvW7ptDaeo
Subject: Re: [dane] Two additions to draft-york-dane-deployment-observations-00
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Nov 2014 04:07:17 -0000

On 11/8/14 6:59 PM, Stephane Bortzmeyer wrote:
> I was not talking about DNSsec monitoring (I already use it, otherwise
> I would never have deployed DNSsec in production for serious domains)
> but about DANE monitoring: get the TLSA record, open a TLS connection,
> get the certificate, check that it is consistent with what the TLSA
> record announces.

Shumon Huque wrote something using the getdns Python bindings that
may be close to what you're asking about:
https://github.com/getdnsapi/getdns-python-bindings/blob/master/examples/checkdanecert.py

Melinda

v2.23.0 | Report a Bug | By Email