Egregoros · Phoenix Framework

Post

Remote status

Context

witch_t *navi

if i use srv records, to say, point _imaps._tcp.vlhl.dev to 993 on ivy.vlhl.dev

the tls certificate for the imap server in that port, does it have to be for vlhl.dev or for ivy.vlhl.dev?

Replying to @navi@social.vlhl.dev

vriska, thief of light

@leo@60228.dev remote

@navi per RFC 2595 it needs to be vlhl.dev: "The client MUST use the server hostname it used to open the connection as the value to compare against the server name as expressed in the server certificate. The client MUST NOT use any form of the server hostname derived from an insecure remote source (e.g., insecure DNS lookup)."
RFC 7817 elaborates on this significantly but is afaik not implemented (its requirements for CAs conflict with CA/B Forum rules, for one), by my reading it would require clients to allow TLS certificates that match the domain part of the user's address and optionally also certs matching the user-entered mail server domain

Replies

Replying to @leo@60228.dev

vriska, thief of light

@leo@60228.dev remote

@navi the safest option is to just request a single cert for both, probably.

Replying to @leo@60228.dev

witch_t *navi

@navi@social.vlhl.dev remote

@leo my plan was to only have servers at subdomains, e.g. $hostname.vlhl.dev -- and not have anything directly on vlhl.dev, but have srv records pointing to the actual services i run

i wanted to do this for pendantism and a clean network topology, not a technical reason

but i guess that doesn't quite work, and, can i even ask for a cert that goes ivy.vlhl.dev and vlhl.dev if those end up going on different machines for some reason? aka, how does the acme challenge work in that case

Replying to @navi@social.vlhl.dev

vriska, thief of light

@leo@60228.dev remote

@navi if you do a dns challenge why would it be a problem

Replying to @leo@60228.dev

witch_t *navi

@navi@social.vlhl.dev remote

@leo i never did a dns challenge before so i have no idea how it works :V

every time i just did it over http-1, so i shall research dns acme challenges

Replying to @navi@social.vlhl.dev

witch_t *navi

@navi@social.vlhl.dev remote

@leo okay namecheap makes that painful

though i suppose i could move my dns in my own servers, dunno if they let me do that but would be cool

Replying to @navi@social.vlhl.dev

vriska, thief of light

@leo@60228.dev remote

@navi you can totally selfhost dns, if you do that you'll want https://certbot-dns-rfc2136.readthedocs.io/en/stable/ for certbot integration. it's just that it's so cheap to run that it almost always makes sense to pay someone else <$1/month to host it with georeplication

Replying to @leo@60228.dev

vriska, thief of light

@leo@60228.dev remote

@navi instead of hosting DNS outright yourself you can also run https://github.com/acme-dns/acme-dns which is a minimal nameserver specifically designed for ACME challenges (via CNAME)

Replying to @leo@60228.dev

vriska, thief of light

@leo@60228.dev remote

@navi if you do want to host dns yourself tl;dr: install bind9, look at the quickstart configurations in https://bind9.readthedocs.io/en/stable/chapter3.html#configuration, on your registrar's settings set the nameserver(s) to the server(s) running bind9. note that the nameserver you set has to itself be a domain name and not an IP address, if you want it to be a subdomain you can make a special kind of record called a "glue record" that's served directly by the registrar and not the normal nameserver. namecheap calls this option a "Personal DNS Server" under "Advanced DNS" settings

Replying to @leo@60228.dev

witch_t *navi

@navi@social.vlhl.dev remote

@leo i am surprised to "the nameserver has to be a domain name", since i'm used to things like 1.1.1.1 and 8.8.8.8 giving me the idea that nameservers are addressed by ip, like if they were A or AAAA records in the top level domain

so, interesting