#tlsa

Here is quick one, you can use various validators online to check weather your DANE TLSA records are correct but number of them do not support multiple certificates and in general they work badly. So best is to test yourself:

Have openssl 1.1.x handy, also RR data for TLSA records will be needed. When you generate them you should know how they look, in case you don’t just use this sample query - in this case SMTP records:

host -t TLSA _25._tcp.onefellow.com _25._tcp.onefellow.com has TLSA record 3 1 1 43EF2EE319070B64915F61B83209D97B3B632EC15B0E89642CE8B7BD 03154D3A _25._tcp.onefellow.com has TLSA record 3 1 1 A254C1E9945AF14159A815A2E74AC48EB04620D4287512950FC2BF71 D7101D1E

As you can see in this example there are 2 certificates, one is RSA and second is ECC. Now, to check if this records match certificate on server use following command for RSA:

openssl s_client -starttls smtp \ -connect onefellow.com:25 \ -cipher ECDHE-RSA-AES128-GCM-SHA256 \ -dane_tlsa_domain "onefellow.com" \ -dane_tlsa_rrdata "3 1 1 a254c1e9945af14159a815a2e74ac48eb04620d4287512950fc2bf71d7101d1e"

In the response you should see something like that:

Verification: OK Verified peername: onefellow.com DANE TLSA 3 1 1 ...287512950fc2bf71d7101d1e matched EE certificate at depth 0

Now, for ECC certificate (note cipher change and hash, gosh):

openssl s_client -starttls smtp \ -connect onefellow.com:25 \ -cipher ECDHE-ECDSA-AES256-GCM-SHA384 \ -dane_tlsa_domain onefellow.com \ -dane_tlsa_rrdata "3 1 1 43EF2EE319070B64915F61B83209D97B3B632EC15B0E89642CE8B7BD03154D3A"

and again, response:

Verification: OK Verified peername: onefellow.com DANE TLSA 3 1 1 ...5b0e89642ce8b7bd03154d3a matched EE certificate at depth 0

Here are some sample error messages you might get:

wrong hash (certificate hash do not match provided hash):

Verification error: No matching DANE TLSA records

wrong domain (domain do not match):

Verification error: Hostname mismatch

Easy, right? Of course you can use above example to test other protocols like http, imap, and whatever is supported.

Here at the Tumblr Love Speading Agency, we love making people smile and we’re always coming up with new ways to do so. We’ve recently come up with a new way to do so and we’re calling it:

The Letters of Love!

Basically every month we’ll send you a letter full of love, positivity and happiness.

These are only available for people in the UK but the USA version will be posted shortly

To request these monthly letters just send us an ask with your name, pronouns and address. We’ll alert you when it’s sent!

You can get these for yourself, family members, friends or anyone that could benefit from them!

Here at the Tumblr Love Speading Agency, our main goal is to make as many people as happy as we possibly can. We are always coming up with new ways to do this and we recently had an idea that we’d like to share with you…

The Make You Smile Kit

These little kits will be made up of

1 tea light

1 box of playdough

1 snack

1 notebook

1 pack of crayons

1 teddy

1 pair of fluffy socks

A letter of love

And will be completely free. These kits are only available for people in the UK but the USA version will be posted shortly.

To request one of these kits, you just need to Reblog this and send us an ask with your name, pronouns and address. It’s that simple! We will alert you when it has been sent.

You can get one of these for yourself, a family member, a friend or anyone you know that could benefit from this.