DNSSec - Revision history

Jan at 07:45, 9 January 2026

2026-01-09T07:45:52Z

← Older revision		Revision as of 07:45, 9 January 2026
Line 5:		Line 5:

	export ZONE=conti.work		export ZONE=conti.work
	sudo pdnsutil add-zone-key $ZONE zsk 1024 active rsasha256		sudo pdnsutil add-zone-key $ZONE zsk 1024 active rsasha256 #not really necessary
	sudo pdnsutil add-zone-key $ZONE ksk 2048 active rsasha256		sudo pdnsutil add-zone-key $ZONE ksk 2048 active rsasha256 #not really necessary

	Set nsec3 parameter [https://deepthought.isc.org/article/AA-00711/0/In-line-Signing-With-NSEC3-in-BIND-9.9-A-Walk-through.html]		Set nsec3 parameter [https://deepthought.isc.org/article/AA-00711/0/In-line-Signing-With-NSEC3-in-BIND-9.9-A-Walk-through.html]
	sudo pdnsutil set-nsec3 $ZONE '1 0 10 db7fcd8a'		sudo pdnsutil set-nsec3 $ZONE '1 0 10 db7fcd8a' #random 32bit number

	sudo pdnsutil secure-zone $ZONE		sudo pdnsutil secure-zone $ZONE

2022-01-04T15:22:47Z

← Older revision		Revision as of 15:22, 4 January 2022
Line 61:		Line 61:
	awk 'BEGIN { x=0;} /-----BEGIN CERTIFICATE-----/ { x++; } (x==1) {print;} /-----END CERTIFICATE-----/ {x++;}' \| \		awk 'BEGIN { x=0;} /-----BEGIN CERTIFICATE-----/ { x++; } (x==1) {print;} /-----END CERTIFICATE-----/ {x++;}' \| \
	openssl x509 -noout -pubkey \| openssl pkey -pubin -outform DER \| openssl sha256		openssl x509 -noout -pubkey \| openssl pkey -pubin -outform DER \| openssl sha256
			{\| class="wikitable"
			\|_25._tcp.mail3 IN TLSA 3 1 1 0bbc34a70d015e83306ed3cdb6534e5e570cbdb4eec6af5585399ea499ab7c3a
			\|}

2022-01-04T15:20:30Z

← Older revision		Revision as of 15:20, 4 January 2022
Line 58:		Line 58:

	Alternative with just public key:		Alternative with just public key:
			openssl s_client -showcerts -servername mail3.r-jan.de -connect mail3.r-jan.de:443 </dev/null 2>/dev/null \| \
	openssl s_client -showcerts -servername mail3.r-jan.de -connect mail3.r-jan.de:443 </dev/null 2>/dev/null \| awk 'BEGIN { x=0;} /-----BEGIN CERTIFICATE-----/ { x++; } (x==1) {print;} /-----END CERTIFICATE-----/ {x++;}' \| openssl x509 -noout -pubkey \| openssl pkey -pubin -outform DER \| openssl sha256		awk 'BEGIN { x=0;} /-----BEGIN CERTIFICATE-----/ { x++; } (x==1) {print;} /-----END CERTIFICATE-----/ {x++;}' \| \
			openssl x509 -noout -pubkey \| openssl pkey -pubin -outform DER \| openssl sha256

2022-01-04T15:19:35Z

← Older revision		Revision as of 15:19, 4 January 2022
Line 56:		Line 56:

	pdnsutil edit-zone jans.space		pdnsutil edit-zone jans.space

			Alternative with just public key:

			openssl s_client -showcerts -servername mail3.r-jan.de -connect mail3.r-jan.de:443 </dev/null 2>/dev/null \| awk 'BEGIN { x=0;} /-----BEGIN CERTIFICATE-----/ { x++; } (x==1) {print;} /-----END CERTIFICATE-----/ {x++;}' \| openssl x509 -noout -pubkey \| openssl pkey -pubin -outform DER \| openssl sha256



	Howto [https://sys4.de/de/blog/2014/05/24/einen-tlsa-record-fuer-dane-mit-bind-9-publizieren/#den-tlsa-record-erstellen] and [http://www.internetsociety.org/deploy360/resources/dane/]		Howto [https://sys4.de/de/blog/2014/05/24/einen-tlsa-record-fuer-dane-mit-bind-9-publizieren/#den-tlsa-record-erstellen] and [http://www.internetsociety.org/deploy360/resources/dane/]

2019-01-28T12:36:59Z

← Older revision		Revision as of 12:36, 28 January 2019
Line 54:		Line 54:
	Add TLSA record to DNS:		Add TLSA record to DNS:
	_25._tcp.conti.work. IN TLSA 3 0 1 9bcd8c83d61e414bd5d935545637a2a98d3f38aaaf5ff9af415ddc574e28ae80		_25._tcp.conti.work. IN TLSA 3 0 1 9bcd8c83d61e414bd5d935545637a2a98d3f38aaaf5ff9af415ddc574e28ae80

			pdnsutil edit-zone jans.space

	Howto [https://sys4.de/de/blog/2014/05/24/einen-tlsa-record-fuer-dane-mit-bind-9-publizieren/#den-tlsa-record-erstellen] and [http://www.internetsociety.org/deploy360/resources/dane/]		Howto [https://sys4.de/de/blog/2014/05/24/einen-tlsa-record-fuer-dane-mit-bind-9-publizieren/#den-tlsa-record-erstellen] and [http://www.internetsociety.org/deploy360/resources/dane/]

2019-01-28T12:34:53Z

← Older revision		Revision as of 12:34, 28 January 2019
Line 50:		Line 50:
	Adding DANE/TLSA record for mail server certificate verification or use this instead [https://www.huque.com/bin/gen_tlsa]		Adding DANE/TLSA record for mail server certificate verification or use this instead [https://www.huque.com/bin/gen_tlsa]

	openssl x509 -in /etc/letsencrypt/live/mail3.~~riechers~~.~~info~~/cert.pem -outform DER \| openssl sha256		openssl x509 -in /etc/letsencrypt/live/mail3.conti.work/cert.pem -outform DER \| openssl sha256

	Add TLSA record to DNS:		Add TLSA record to DNS:

2019-01-28T12:33:48Z

← Older revision		Revision as of 12:33, 28 January 2019
Line 43:		Line 43:

	[https://doc.powerdns.com/md/authoritative/dnssec/]		[https://doc.powerdns.com/md/authoritative/dnssec/]

			To renew the certificate run on mail:
			certbot --dns-rfc2136 --dns-rfc2136-credentials /etc/letsencrypt/dns-rfc2136.ini renew

2017-11-21T17:45:36Z

← Older revision		Revision as of 17:45, 21 November 2017
Line 68:		Line 68:

	[https://doc.powerdns.com/md/authoritative/dnsupdate/]		[https://doc.powerdns.com/md/authoritative/dnsupdate/]

			To notify slaves use:
			sudo pdnsutil set-meta r-jan.de ALSO-NOTIFY 185.181.104.96

2017-04-19T07:54:03Z

← Older revision		Revision as of 07:54, 19 April 2017
Line 58:		Line 58:

	For dynamic update setup zone with ALLOW-DNSUPDATE-FROM		For dynamic update setup zone with ALLOW-DNSUPDATE-FROM
			pdnsutil set-meta $ZONE ALLOW-DNSUPDATE-FROM 172.16.0.0/15
			pdnsutil set-meta $ZONE TSIG-ALLOW-DNSUPDATE dyndns
			or

	select id from domains where name='conti.work';		select id from domains where name='conti.work';
	8		8

2017-04-19T07:49:23Z

← Older revision		Revision as of 07:49, 19 April 2017
Line 5:		Line 5:

	export ZONE=conti.work		export ZONE=conti.work
	sudo ~~pdnssec~~ add-zone-key $ZONE zsk 1024 active rsasha256		sudo pdnsutil add-zone-key $ZONE zsk 1024 active rsasha256
	sudo ~~pdnssec~~ add-zone-key $ZONE ksk 2048 active rsasha256		sudo pdnsutil add-zone-key $ZONE ksk 2048 active rsasha256

	Set nsec3 parameter [https://deepthought.isc.org/article/AA-00711/0/In-line-Signing-With-NSEC3-in-BIND-9.9-A-Walk-through.html]		Set nsec3 parameter [https://deepthought.isc.org/article/AA-00711/0/In-line-Signing-With-NSEC3-in-BIND-9.9-A-Walk-through.html]
	sudo ~~pdnssec~~ set-nsec3 $ZONE '1 0 10 db7fcd8a'		sudo pdnsutil set-nsec3 $ZONE '1 0 10 db7fcd8a'

	sudo ~~pdnssec~~ secure-zone $ZONE		sudo pdnsutil secure-zone $ZONE
	sudo ~~pdnssec~~ rectify-zone $ZONE		sudo pdnsutil rectify-zone $ZONE

	Upload public KSK ZSK [https://www.gandi.net/admin/domain/dnssec/5104640]		Upload public KSK ZSK [https://www.gandi.net/admin/domain/dnssec/5104640]
Line 18:		Line 18:

	Or alternatively use:		Or alternatively use:
	~~pdnssec~~ show-zone -v $ZONE		pdnsutil show-zone -v $ZONE
	Zone is not presigned		Zone is not presigned
	Zone has hashed NSEC3 semantics, configuration: 1 0 10 db7fcd8a		Zone has hashed NSEC3 semantics, configuration: 1 0 10 db7fcd8a