Why there are no hashes in cloudflare sdns string? about dnscrypt-resolvers HOT 6 CLOSED

Cloudflare certificates change all the time, so this is unfortunately impossible to maintain.

And yes, it means that it is completely insecure against adversaries having power of certificate authorities, and products adding their own CAs.

from dnscrypt-resolvers.

@jedisct1

One year ago (early Jan) I imported new cloudflare's cert into my mikrotik router and set up DOH on it with enabled "Verify DoH Certificate". It works no problems since that time. Just to make sure, I compared the cert on my router and on cloudflare - they are the same.

Do you consider yearly certs as too much volatile or do I miss something?

from dnscrypt-resolvers.

It was far more frequent. Hashes were removed in 2020. Maybe things have stabilized since? That would be surprising, though. I have websites fronted by Cloudflare and the certificate chain keeps changing at least twice a month.

What stamp are you using?

from dnscrypt-resolvers.

Current hash is:

 [CN=Cloudflare Inc ECC CA-3,O=Cloudflare\, Inc.,C=US] [9cbba0fc962f7a2b31c62b1b175a2de4c50a8395727e30b626a80009a780e3d8]

from dnscrypt-resolvers.

My config

server_names = ['cloudflare-static']

..

[static]

[static.'cloudflare-static']
stamp = 'sdns://AgcAAAAAAAAABzEuMC4wLjEAEmRucy5jbG91ZGZsYXJlLmNvbQovZG5zLXF1ZXJ5'

Sample run:

> dnscrypt-proxy -show-certs
[2023-12-29 23:29:23] [NOTICE] dnscrypt-proxy 2.0.45
[2023-12-29 23:29:23] [NOTICE] Firefox workaround initialized
[2023-12-29 23:29:24] [NOTICE] Advertised cert: [CN=cloudflare.com,O=Cloudflare\, Inc.,L=San Francisco,ST=California,C=US] [8daa18baf94b4af89d1079557b901674e94e66974a8504a32bfaf1eb3fa5700d]
[2023-12-29 23:29:24] [NOTICE] Advertised cert: [CN=Cloudflare Inc ECC CA-3,O=Cloudflare\, Inc.,C=US] [9cbba0fc962f7a2b31c62b1b175a2de4c50a8395727e30b626a80009a780e3d8]
[2023-12-29 23:29:24] [NOTICE] [cloudflare-static] OK (DoH) - rtt: 45ms
[2023-12-29 23:29:24] [NOTICE] Server with the lowest initial latency: cloudflare-static (rtt: 45ms)

from dnscrypt-resolvers.

Cloudflare are also still using Digicert (at least for the "family" and "security" resolvers) and we need another CA for people choosing the RSA cipher suites.

d46ec48 re-adds these certs. Hopefully these are the same everywhere in the world. Let's see how long it takes before something breaks.

from dnscrypt-resolvers.