<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-text-plain" wrap="true" style="font-family:
-moz-fixed; font-size: 12px;" lang="x-western">
<pre class="moz-quote-pre" wrap="">On 12/31/18 2:21 PM, Viktor Dukhovni wrote:
</pre>
<blockquote type="cite" style="color: #000000;">
<blockquote type="cite" style="color: #000000;">
<pre class="moz-quote-pre" wrap="">On Dec 31, 2018, at 2:01 PM, zorion <a class="moz-txt-link-rfc2396E" href="mailto:zorion@autistici.org"><zorion@autistici.org></a> wrote:
Ok, I had a hard time finding out what exactly the <b class="moz-txt-star"><span class="moz-txt-tag">*</span>trust-anchor<span class="moz-txt-tag">*</span></b> was
supposed to be. I took a guess that it was the combined cert chain, but
obviously that is not it.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">A trust-anchor is any issuing CA you designate as trusted, and it does
not have to be a root CA, it can also be any intermediate CA.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Thank you for the explanation!
</pre>
<blockquote type="cite" style="color: #000000;">
<blockquote type="cite" style="color: #000000;">
<pre class="moz-quote-pre" wrap="">What exactly is the trust-anchor? Is it the top level cert from the CA
in the chain (#4 in your danecheck below)?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">It is any of 2, 3 or 4. The important constraint with DANE-TA(2), as
explained in <a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/rfc7671#section-5.2.2">https://tools.ietf.org/html/rfc7671#section-5.2.2</a>, is
that if you do choose a root CA as your trust-anchor, unlike the
case in non-DANE PKIX protocols, it MUST be sent to the client along
with the intermediate issuer certificates.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Would that be the smtp_tls_CAfile option in postfix? I've got an
intermediate bundle that I provide to that option in main.cf
</pre>
<blockquote type="cite" style="color: #000000;">
<pre class="moz-quote-pre" wrap="">To compute the digest of a CA certificate, create a PEM file containing
just that certificate. Or use my "chaingen" script (attached), which
can process a complete chain of certificates, but DO NOT then publish
all the TLSA records it outputs. Publish no more than one TLSA record
per certificate in the chain, typically just the "3 1 1" for the EE
cert, and "2 1 1" for the TA certs. And no need to match at every
level. At most two trust anchors (typically just one) are enough.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Thanks! Is there a benefit for also publishing the "2 1 1" TA certs if
I'm already publishing the "3 1 1" EE cert?
ps. accidentally only sent this directly to Viktor, sending it to the list.</pre>
</div>
</body>
</html>