42 lines
1.8 KiB
Markdown
42 lines
1.8 KiB
Markdown
# OVH DANE Companion
|
|
|
|
> Untested code ahead! This was done in a rush and isn't tested! It *should* work,
|
|
> but I wouldn't be surprised if it breaks sometimes.
|
|
|
|
## Aim
|
|
|
|
I wanted to implement in a matter of a few days worth of free time a companion
|
|
container for my Let's Encrypt container. My certificates are generated by a
|
|
Docker container, and I wanted to deploy TLSA records automatically.
|
|
|
|
DANE and TLSA records are used to avoid TLS downgrade attacks, such as during a
|
|
MITM attacks.
|
|
|
|
I also wanted to have a 100% score on internet.nl for my email server security,
|
|
and I got [it](https://internet.nl/mail/louis-vallat.xyz/671317/).
|
|
|
|
## Rollover scheme
|
|
|
|
There **isn't** any. I could add a "2 1 1" record using Let's Encrypt's root certificates,
|
|
but then I could just use permanently a "2 1 1" record and the "3 1 1" record would
|
|
be useless.
|
|
|
|
As I used an external container to renew the certificates, I cannot modify the
|
|
renewal procedure, so I can't use the "current + next" rollover scheme.
|
|
|
|
In compensation, I set the TLSA TLLs as the lowest my DNS provider allows: 60 seconds.
|
|
In case of a key rollover, the TLSA records will be wrong for **at most** 2 minutes
|
|
(2 TTLs just to make sure), as long as some entity on the way doesn't keep the record
|
|
longer than the TTL specified (that can happen with lazy ISPs). TLSA records being
|
|
borked for 2 minutes once every few months shouldn't be an issue.
|
|
|
|
Although this is not new, maybe a bit young (from 2012), this technology isn't
|
|
widely spread.
|
|
|
|
## References and links
|
|
|
|
- Article from Abyss Project: [link](https://www.abyssproject.net/2016/09/creer-utiliser-enregistrements-tlsa-dane/)
|
|
- Internet technologies tester: [link](https://internet.nl/)
|
|
- SMTP Protection HowTo: [link](https://github.com/internetstandards/toolbox-wiki)
|
|
- OVH API: [link](https://eu.api.ovh.com/)
|