<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Sounds like this: <a href="https://gitlab.isc.org/isc-projects/bind9/-/issues/3896">https://gitlab.isc.org/isc-projects/bind9/-/issues/3896</a><br id="lineBreakAtBeginningOfSignature"><div dir="ltr"><div>--</div>Ondřej Surý — ISC (He/Him)<div><br></div><div>My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.</div></div><div dir="ltr"><br><blockquote type="cite">On 4. 3. 2025, at 10:01, Klaus Darilion via bind-users <bind-users@lists.isc.org> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>@font-face { font-family: "Cambria Math"; }
@font-face { font-family: Calibri; }
@font-face { font-family: Aptos; }
p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0cm; font-size: 11pt; font-family: Aptos, sans-serif; }
a:link, span.MsoHyperlink { color: rgb(70, 120, 134); text-decoration: underline; }
span.E-MailFormatvorlage19 { font-family: Aptos, sans-serif; color: windowtext; }
.MsoChpDefault { font-size: 10pt; }
@page WordSection1 { size: 612pt 792pt; margin: 70.85pt 70.85pt 2cm; }
div.WordSection1 { page: WordSection1; }</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-ligatures:none">May it be, that the validation is just broken? Even when using dig, and explicitely use the hostname of the Primary (which uses its hostname in its certificate) in @... and tls-hostname, the verification
fails due to hostname mismatch:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"><o:p> </o:p></span></p>
<p class="MsoNormal"># dig @xot-test-primary.ops.nic.at test.klaus +tls axfr +tls-ca=ca.crt +tls-hostname=xot-test-primary.ops.nic.at +tls-certfile=certificate.crt +tls-keyfile=private.key<o:p></o:p></p>
<p class="MsoNormal">;; TLS peer certificate verification for 193.46.106.51#853 failed: hostname mismatch<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards<o:p></o:p></p>
<p class="MsoNormal">Klaus<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;mso-ligatures:none">From:</span></b><span style="font-family:"Calibri",sans-serif;mso-ligatures:none"> Klaus Darilion
<br>
<b>Sent:</b> Thursday, February 27, 2025 5:11 PM<br>
<b>To:</b> Greg Choules via bind-users <bind-users@lists.isc.org><br>
<b>Subject:</b> XoT Testing: TLS peer certificate verification failed<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi! I want to test XoT between Bind9.20.6 primary and secondary.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the primary I created a self-signed certificate with CN=xot-test-primary.ops.nic.at and configured bind:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># Create a 10years valid self-signed certificate:<o:p></o:p></p>
<p class="MsoNormal"># openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048<o:p></o:p></p>
<p class="MsoNormal"># openssl req -new -key private.key -out request.csr -subj "/CN=xot-test-primary.ops.nic.at"<o:p></o:p></p>
<p class="MsoNormal"># openssl x509 -req -days 3650 -in request.csr -signkey private.key -out certificate.crt<o:p></o:p></p>
<p class="MsoNormal"># openssl x509 -text -noout -in certificate.crt<o:p></o:p></p>
<p class="MsoNormal"># chmod g+r private.key<o:p></o:p></p>
<p class="MsoNormal">#<o:p></o:p></p>
<p class="MsoNormal"># Create DH-params file to enable Diffie-Hellman Perfect Forward Secrecy:<o:p></o:p></p>
<p class="MsoNormal"># openssl dhparam -out dhparam.pem 4096<o:p></o:p></p>
<p class="MsoNormal">#<o:p></o:p></p>
<p class="MsoNormal"># <a href="https://bind9.readthedocs.io/en/v9.20.6/reference.html#namedconf-statement-tls">
https://bind9.readthedocs.io/en/v9.20.6/reference.html#namedconf-statement-tls</a><o:p></o:p></p>
<p class="MsoNormal">tls xot-test {<o:p></o:p></p>
<p class="MsoNormal"> cert-file "/etc/bind/certificate.crt";<o:p></o:p></p>
<p class="MsoNormal"> dhparam-file "/etc/bind/dhparam.pem";<o:p></o:p></p>
<p class="MsoNormal"> key-file "/etc/bind/private.key";<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">options {<o:p></o:p></p>
<p class="MsoNormal"> listen-on { 193.46.106.51; };<o:p></o:p></p>
<p class="MsoNormal"> listen-on-v6 { 2a02:850:1:4::51; };<o:p></o:p></p>
<p class="MsoNormal"> listen-on tls xot-test { 193.46.106.51; };<o:p></o:p></p>
<p class="MsoNormal"> listen-on-v6 tls xot-test { 2a02:850:1:4::51; };<o:p></o:p></p>
<p class="MsoNormal">};<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-ligatures:none">That seems to work fine. Then I configured the secondary similar:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># Create a 10years valid self-signed certificate:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># openssl genpkey -algorithm RSA -out private.key -pkeyopt rsa_keygen_bits:2048<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># openssl req -new -key private.key -out request.csr -subj "/CN=xot-test-secondary.ops.nic.at"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># openssl x509 -req -days 3650 -in request.csr -signkey private.key -out certificate.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># openssl x509 -text -noout -in certificate.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># chmod g+r private.key<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none">#<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># Create DH-params file to enable Diffie-Hellman Perfect Forward Secrecy:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># openssl dhparam -out dhparam.pem 4096<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none">#<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"># <a href="https://bind9.readthedocs.io/en/v9.20.6/reference.html#namedconf-statement-tls">
https://bind9.readthedocs.io/en/v9.20.6/reference.html#namedconf-statement-tls</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none">tls xot-test {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"> #ca-file "/etc/bind/ca.crt"; # Activating ca-file force client-certificates for incoming TLS connections<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"> cert-file "/etc/bind/certificate.crt";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"> dhparam-file "/etc/bind/dhparam.pem";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"> key-file "/etc/bind/private.key";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"> #remote-hostname "xot-test-primary.ops.nic.at";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none">}; // may occur multiple times<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">zone "test.klaus" {<o:p></o:p></p>
<p class="MsoNormal"> type secondary;<o:p></o:p></p>
<p class="MsoNormal"> file "/var/cache/bind/test.klaus"; // Path to your zone file<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> primaries {<o:p></o:p></p>
<p class="MsoNormal"> 193.46.106.51 key "tsig-key" tls xot-test;<o:p></o:p></p>
<p class="MsoNormal"> 2a02:850:1:4::51 key "tsig-key" tls xot-test;<o:p></o:p></p>
<p class="MsoNormal"> };<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I copied the primary’s <span style="mso-ligatures:none">certificate.crt to the secondary as ca.crt.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="mso-ligatures:none">Using opportunistic TLS, zone transfer works fine.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none">But if I enable strict TLS, either by uncommenting ‘ca-file’ or ‘remote-hostname’ option, the TLS verification fails:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"><o:p> </o:p></span></p>
<p class="MsoNormal"> transfer of 'test.klaus/IN' from 193.46.106.51#853: failed to connect: TLS peer certificate verification failed<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But the setup on the primary looks fine. I can successfully open a TLS connection when using curl:<o:p></o:p></p>
<p class="MsoNormal"># curl -v <a href="https://xot-test-primary.ops.nic.at:853">
https://xot-test-primary.ops.nic.at:853</a> --cacert ca.crt<o:p></o:p></p>
<p class="MsoNormal">* Host xot-test-primary.ops.nic.at:853 was resolved.<o:p></o:p></p>
<p class="MsoNormal">* IPv6: (none)<o:p></o:p></p>
<p class="MsoNormal">* IPv4: 193.46.106.51<o:p></o:p></p>
<p class="MsoNormal">* Trying 193.46.106.51:853...<o:p></o:p></p>
<p class="MsoNormal">* Connected to xot-test-primary.ops.nic.at (193.46.106.51) port 853<o:p></o:p></p>
<p class="MsoNormal">* ALPN: curl offers h2,http/1.1<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (OUT), TLS handshake, Client hello (1):<o:p></o:p></p>
<p class="MsoNormal">* CAfile: ca.crt<o:p></o:p></p>
<p class="MsoNormal">* CApath: /etc/ssl/certs<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (IN), TLS handshake, Server hello (2):<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (IN), TLS handshake, Certificate (11):<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (IN), TLS handshake, CERT verify (15):<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (IN), TLS handshake, Finished (20):<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):<o:p></o:p></p>
<p class="MsoNormal">* TLSv1.3 (OUT), TLS handshake, Finished (20):<o:p></o:p></p>
<p class="MsoNormal">* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519 / RSASSA-PSS<o:p></o:p></p>
<p class="MsoNormal">* ALPN: server did not agree on a protocol. Uses default.<o:p></o:p></p>
<p class="MsoNormal">* Server certificate:<o:p></o:p></p>
<p class="MsoNormal">* subject: CN=xot-test-primary.ops.nic.at<o:p></o:p></p>
<p class="MsoNormal">* start date: Feb 27 14:02:56 2025 GMT<o:p></o:p></p>
<p class="MsoNormal">* expire date: Feb 25 14:02:56 2035 GMT<o:p></o:p></p>
<p class="MsoNormal">* common name: xot-test-primary.ops.nic.at (matched)<o:p></o:p></p>
<p class="MsoNormal">* issuer: CN=xot-test-primary.ops.nic.at<o:p></o:p></p>
<p class="MsoNormal">* SSL certificate verify ok.<o:p></o:p></p>
<p class="MsoNormal">* Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So, what am I doing wrong? Is Bind using a not-trivial TLS certificate verification? I also failed getting more verbose verification details. Any help is appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal">Klaus<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></body></html>