<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Never mind. Rebooting the box resolved it. I’m still curious how it got crossed<br class=""><div class="">
<meta charset="UTF-8" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; font-family: Helvetica; font-style: normal; font-weight: normal; font-size: 15px; text-align: start; text-indent: 0px;"><span style="font-family: InputMono-Regular;" class=""><br class="Apple-interchange-newline">--</span></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; font-style: normal; font-weight: normal; font-size: 15px; text-align: start; text-indent: 0px;"><font face="Arial" class="">Eric Germann</font></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; font-style: normal; font-weight: normal; text-align: start; text-indent: 0px;"><span style="font-size: 11px;" class=""><font face="Arial" class="">ekgermann {at} semperen {dot} com || ekgermann {at} gmail {dot} com</font></span></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; text-align: start; text-indent: 0px;" class=""><span style="font-size: 11px;" class=""><font face="Arial" class=""><font style="font-style: normal; font-weight: normal;" class="">LinkedIn: </font><span style="font-style: normal;" class=""><a href="https://www.linkedin.com/in/ericgermann" class="">https://www.linkedin.com/in/ericgermann</a></span></font></span></div><div style="text-align: start; text-indent: 0px;" class=""><span style="font-size: 11px;" class=""><font face="Arial" class="">Medium:<span class="Apple-converted-space"> </span><a href="https://ekgermann.medium.com" class="">https://ekgermann.medium.com</a> </font></span></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; font-style: normal; font-weight: normal; font-size: 15px; text-align: start; text-indent: 0px;" class=""><span style="font-size: 12px;" class=""><font face="Arial" class="">Twitter: @ekgermann</font></span></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; font-style: normal; font-weight: normal; font-size: 15px; text-align: start; text-indent: 0px;" class=""><span style="font-size: 11px;" class=""><font face="Arial" class="">Telegram || Signal || Skype || Phone +1 {dash} 419 {dash} 513 {dash} 0712</font></span></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; font-family: Helvetica; font-style: normal; font-weight: normal; font-size: 15px; text-align: start; text-indent: 0px;" class=""><span style="font-family: InputMono-Regular; font-size: 11px;" class=""><br class=""></span></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; text-align: start; text-indent: 0px;" class=""><font face="InputMono-Regular" style="font-family: Helvetica; font-style: normal; font-weight: normal; font-size: 15px;" class=""><span style="font-size: 12px;" class="">GPG Fingerprint:<span class="Apple-converted-space"> </span></span></font><font face="Arial" class=""><span style="font-style: normal; font-size: 11px;" class="">89ED 36B3 515A 211B 6390 60A9 E30D 9B9B 3EBF F1A1</span></font></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px; text-align: start; text-indent: 0px;" class=""><br class=""></div><div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px;" class=""><font face="InputMono-Regular" class=""><span style="font-style: normal; font-size: 11px;" class=""><br class=""></span></font></div></div><font face="InputMono-Regular" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px;" class=""><span style="font-style: normal; font-size: 11px;" class=""><br class="Apple-interchange-newline"></span></font></div><font face="InputMono-Regular" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px;" class=""><span style="font-style: normal; font-size: 11px;" class=""><br class="Apple-interchange-newline"></span></font></div><font face="InputMono-Regular" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px;" class=""><span style="font-style: normal; font-size: 11px;" class=""><br class="Apple-interchange-newline" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-variant-caps: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"></span></font><br class="Apple-interchange-newline"></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Oct 6, 2022, at 19:02, Eric Germann via bind-users <<a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">I’m having a really weird issue with 9.18.3<br class=""><br class="">When I connect with OpenSSL to this particular server, I get two different server certs<br class=""><br class="">Here is my requisite configs<br class=""><br class=""> listen-on port 53 { any; };<br class=""> listen-on port 443 tls local-tls http local-http-server { any; };<br class=""> listen-on port 853 tls local-tls { any; };<br class=""> listen-on-v6 port 53 { any; };<br class=""> listen-on-v6 port 443 tls local-tls http local-http-server { any; };<br class=""> listen-on-v6 port 853 tls local-tls { any; };<br class=""> http-port 80;<br class=""> https-port 443;<br class="">};<br class=""><br class="">tls local-tls {<br class=""> key-file "/etc/namedb/keys/privkey.pem";<br class=""> cert-file "/etc/namedb/keys/fullchain.pem";<br class="">};<br class=""><br class="">http local-http-server {<br class=""> endpoints { "/dns-query"; };<br class="">};<br class=""><br class="">my last line of the cert in fullchain.pem for the correct server cert is<br class=""><br class="">"+sWJ8Oluyktfz7I5MSsXwIqCMK/4qG/S4hf04FUk"<br class=""><br class=""><br class="">When I connect to port 443 for DoH, I get a server cert that ends in “FUk”<br class=""><br class="">When I connect to port 853 for DoT, I get a server cert that ends in “HhQraavJaViojiiFyfcKONWCPVuQozJDWoICan7i”. The issue is when I execute<br class=""><br class="">kdig -d @ns05x.semperen.com +tls-sni=<a href="http://ns05x.semperen.com" class="">ns05x.semperen.com</a> +tls-host=<a href="http://ns05x.semperen.com" class="">ns05x.semperen.com</a> <a href="http://semperen.com" class="">semperen.com</a> mx<br class=""><br class="">I get back <br class=""><br class="">;; DEBUG: Querying for owner(<a href="http://semperen.com" class="">semperen.com</a>.), class(1), type(15), server(<a href="http://ns05x.semperen.com" class="">ns05x.semperen.com</a>), port(853), protocol(TCP)<br class="">;; DEBUG: TLS, imported 127 system certificates<br class="">;; DEBUG: TLS, received certificate hierarchy:<br class="">;; DEBUG: #1, CN=<a href="http://ns05x.semperen.com" class="">ns05x.semperen.com</a><br class="">;; DEBUG: SHA-256 PIN: WLEeS4l9ObJUnZ1X055NrxlYkzaep5Ynig7KA8GnuqE=<br class="">;; DEBUG: #2, C=US,O=Let's Encrypt,CN=R3<br class="">;; DEBUG: SHA-256 PIN: jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=<br class="">;; DEBUG: #3, C=US,O=Internet Security Research Group,CN=ISRG Root X1<br class="">;; DEBUG: SHA-256 PIN: C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=<br class="">;; DEBUG: TLS, skipping certificate PIN check<br class="">;; DEBUG: TLS, The certificate is NOT trusted. The certificate chain uses expired certificate. <br class="">;; WARNING: TLS, handshake failed (Error in the certificate.)<br class="">;; DEBUG: TLS, received certificate hierarchy:<br class="">;; DEBUG: #1, CN=<a href="http://ns05x.semperen.com" class="">ns05x.semperen.com</a><br class="">;; DEBUG: SHA-256 PIN: WLEeS4l9ObJUnZ1X055NrxlYkzaep5Ynig7KA8GnuqE=<br class="">;; DEBUG: #2, C=US,O=Let's Encrypt,CN=R3<br class="">;; DEBUG: SHA-256 PIN: jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=<br class="">;; DEBUG: #3, C=US,O=Internet Security Research Group,CN=ISRG Root X1<br class="">;; DEBUG: SHA-256 PIN: C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=<br class="">;; DEBUG: TLS, skipping certificate PIN check<br class="">;; DEBUG: TLS, The certificate is NOT trusted. The certificate chain uses expired certificate. <br class="">;; WARNING: TLS, handshake failed (Error in the certificate.)<br class="">;; ERROR: failed to query server <a href="http://ns05x.semperen.com" class="">ns05x.semperen.com</a>@853(TCP)<br class=""><br class=""><br class="">Which says the cert is expired. When checking the cert with OpenSSL that is returned, the start and end dates are the same, Jul 4 2022.<br class=""><br class="">In the LetsEncrypt dir, in “archive” dorectory fullchain7.pem is the current cert and the symbolic link in “live” is linked to this. However, that tail end of the incorrect server cert is contained in "fullchain5.pem”, and it is expired. I relinked the files to make sure it wasn’t a file system issue. How is it picking up the wrong full chain when I point it to a dir with only the links to chain7?<br class=""><br class="">Querying <a href="http://ns04x.semperen.com" class="">ns04x.semperen.com</a> returns the same cert on both ports.<br class=""><br class="">Thanks for any pointers<br class=""><br class="">--<br class="">Eric Germann<br class="">ekgermann {at} semperen {dot} com || ekgermann {at} gmail {dot} com<br class="">LinkedIn: <a href="https://www.linkedin.com/in/ericgermann" class="">https://www.linkedin.com/in/ericgermann</a><br class="">Medium: <a href="https://ekgermann.medium.com" class="">https://ekgermann.medium.com</a> <br class="">Twitter: @ekgermann<br class="">Telegram || Signal || Skype || Phone +1 {dash} 419 {dash} 513 {dash} 0712<br class=""><br class="">GPG Fingerprint: 89ED 36B3 515A 211B 6390 60A9 E30D 9B9B 3EBF F1A1<br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class="">-- <br class="">Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" class="">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br class=""><br class="">ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" class="">https://www.isc.org/contact/</a> for more information.<br class=""><br class=""><br class="">bind-users mailing list<br class=""><a href="mailto:bind-users@lists.isc.org" class="">bind-users@lists.isc.org</a><br class="">https://lists.isc.org/mailman/listinfo/bind-users<br class=""></div></div></blockquote></div><br class=""></body></html>