Thanks for the video link. I am wondering how you managed to get DoT working with a hostname. I get the following error when trying to do DoT upstream: notice: ssl handshake failed 8.8.8.8 port 853 [1706721743] unbound[15556:2] error: ssl handshake failed crypto error:0A000086:SSL routines::certificate verify failed
> -----Original Message----- > From: Peter Hessler <phess...@theapt.org> > Sent: Wednesday, January 31, 2024 2:24 PM > To: Bruno Blanes <bruno.bla...@outlook.com> > Cc: unbound-users@lists.nlnetlabs.nl > Subject: Re: Unbound DoT with LetsEncrypt certificate > > On 2024 Jan 31 (Wed) at 17:14:22 +0000 (+0000), Bruno Blanes via > Unbound-users wrote: > :Has anyone been able to use DoT upstream with a LetsEncrypt certificate? I > know they don't issue certificates on bare IP addresses and therefore the > upstream server may not be able to verify Unbound's signature based only on > the domain name. > : > :Do I need a certificate for Unbound's IP address for DoT to work? If so, is > there > a free CA that emits those? > > I am doing DoT with a hostname, but sadly no bare IPs in the certificate. I > just > got a regular certificate using ACME, saved it to a spot unbound can read and > just send a reload when it changes. > > > RIPE NCC did try to deploy Discovery of Designated Resolvers (RFC9462), > which depends on bare IPs in the cert, at the RIPE 87 meeting in December > 2023, but found that LE does not support bare IPs. > > For more details: > https://ripe87.ripe.net/archives/video/1267/ > Starting at Page 15 of the slides > Starting at 9:00 of the video > > > -- > What I've done, of course, is total garbage. > -- R. Willard, Pure Math 430a