DuckCorp » DuckCorp Infrastructure

There is already a Firefox addon for TLSA:
https://os3sec.org/

I still don't know if there are tools to generate the DNS entries easily.

This we i configured www.hq.dc.o to do some tests, and the settings were quite easy. Note that the TXT field is already deprecated according to the VCS commits.

The plugin is not meant to be installed on FF10 but can be forced and seems to work. Nevertheless i was not able to get him validate anything, as it consider the DNSSEC chain to be broken, and activating debug in about:config did not output anything on the webconsoles or on STDOUT.

Modified mkcert to generate the SubjectPublicKeyInfo hashes for a server (for the CN is applicable and all DNS entries in subjectAltName), then for all servers of a CA.
The services needed to be specified in the server configuration file, using the service name (NSS) or port/proto. Sometimes it is also needed to restrict certain services to specific hostnames, so the scope can be narrowed in the syntax.

• The mapping of the resulting bunch of TLSA records needs to be mapped to domain names, taking care of which domain is currently DNSSEC enabled.
• Entries also need to be properly dispatched in the right parent/child domain (in case of subdomains).
• The filtered result need to be pushed to the MX1 of the domain.
• opendnssec needs to be triggered

As these last steps are not very easy, and to test the results, i created the adm_publish_tlsa script doing what's needed for the only domains able to take advantage of it.

I recreated the previous script in Ruby to handle all the listed steps and it works well, giving the same exact output as before.

In order to have the necessary knowledge to do the job, I created /etc/mp-admin/topology with necessary information.