XMPP Service Operators - 2022-02-22

expat update is in fedora updates-testing for f34 and f35

dnf update --refresh --enablerepo=updates-testing expat *xml*

Wow https://social.tchncs.de/@trashserver/107836342028385529

> Establishing a secure connection from mdosch.de to muc.poez.io failed. Certificate hash: 0206e623a7a8b86bdc6be15f3fd481ac5903a4b387f0c390dc47aac228688d48. Error with certificate 0: certificate has expired.

👮👮👮

Our friendly neighbor cert officer

😁

Just put all your xmpp services on o.j.n and I have a quiet time. 😃

croax, Licaon_Kter: You can use the `validationmethods` CAA parameter to limit allowed validation methods

Example `letsencrypt.org; validationmethods=dns-01`

List of all methods?

> List of all methods? Licaon_Kter: what do you mean? What are the allowed methods?

Yes...so dns-01 and?

Licaon_Kter: seems like RFC only defines issue, issuewild, iodef https://www.rfc-editor.org/rfc/rfc8659.html There's an extension for this only param in https://datatracker.ietf.org/doc/html/rfc8657#section-4

Which refers to existing methods https://datatracker.ietf.org/doc/html/rfc8555#section-9.7.8 http-01 | dns dns-01 | dns tls-sni-01 | RESED tls-sni-02 RESERVED

Licaon_Kter: `http-01`, `dns-01` and `tls-alpn-01` for Let's Encrypt.

So acme.sh static method is which exactly?

Licaon_Kter: The `.well-known`?

Licaon_Kter: acme.sh is probably http-01 as running a standalone webserver

dns-01 need access to write a TXT in targeted DNS zone, more complex set-up. ✏

mimi89999: no, my bad, not static, https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mode

Still .well-known, so http-01, no?

I guess, right

Reading it, it might be already protected from this attack since they can't use the account to generate the new certs?

Licaon_Kter: just register another account. You can't block anything with registration on LE.

Yeah, I think a domain isn't bound to an account, nor to an email address ✏

Oh ffs

I had to create new accounts multiple times for my domain, although I think I used the same email...

Yes, I know So > Example `letsencrypt.org; validationmethods=http-01` ...is useless

As an attack mitigation, seems like it

What would that mitigate against?

But limiting validation methods to dns might protect against BGP hijacking

Still a very unlikely attack, but possible. Was that the first time BGP was used to obtain a TLS cert?

> What would that mitigate against? This > But limiting validation methods to dns might protect against BGP hijacking ;)

Oh wait, it's about placing restrictions _into dns_. So if you had dnssec on your domain, you could forbid certain validation methods

Including forbidding cert issuance entirely, probably ;) ✏

dns-01 method: so you need to provide a write access token to the DNS zone from the host which runs certbot. The cure is worse that the disease, no? ✏

a good DNS provider will let you restric that token to only have write access to the _acme-challenge TXT record

(and you might be able to leverage a CNAME to help you with that)

jonas’: thanks. Searching if this is possible here.

croax, if it only allows you to restrict to a sub-zone, e.g. foo.example.com, but without restricting record type, I'd suggest to go with a _acme-challenge.domain.example CNAME _acme-challenge.foo.domain.example and let the token manage foo.domain.example

jonas’: Great, good advice. I had a look at OVH API in "zone". It seems access token can only be restricted by URL prefix path... but {zone} seems to provide unlimited access to names and sub domains. https://api.ovh.com/console/?#/domain/zone/ If anyone knows...