shuque / gotls Goto Github PK
View Code? Open in Web Editor NEWDiagnostic tool to perform DANE & PKIX authentication of a TLS server
License: GNU General Public License v3.0
Diagnostic tool to perform DANE & PKIX authentication of a TLS server
License: GNU General Public License v3.0
When I check mail.bayern.de with the command gotls -4 -d -m dane -s smtp -r 8.8.8.8 mail.bayern.de 25
, I receive the following output stating that name check failed.
#Host: mail.bayern.de Port: 25
SNI: mail.bayern.de
STARTTLS application: smtp
DNS TLSA RRset:
qname: _25._tcp.mail.bayern.de.
2 0 1 32a2bc1d515cdbc412b62b47a1cccf2bb1b8e3ef309f982458d3a7c61797422a
IP Addresses found:
195.200.70.95
195.200.70.104
## Checking mail.bayern.de 195.200.70.95 port 25
DANE TLSA 2 0 1 [32a2bc1d..]: FAIL matched TA certificate at depth 1 but name check failed
## STARTTLS Transcript:
recv: 220 mail96.bayern.de ESMTP Bavarian Mail Gateway; Tue, 1 Feb 2022 16:48:09 +0100
send: EHLO v22019048273988146
recv: 250-mail96.bayern.de Hello, pleased to meet you
recv: 250-ENHANCEDSTATUSCODES
recv: 250-PIPELINING
recv: 250-8BITMIME
recv: 250-SIZE 50000000
recv: 250-DSN
recv: 250-ETRN
recv: 250-STARTTLS
recv: 250-DELIVERBY
recv: 250 HELP
send: STARTTLS
recv: 220 2.0.0 Ready to start TLS
## Peer Certificate Chain:
0 CN=mail.bayern.de,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
1 CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
## Verified Certificate Chain 0:
0 CN=mail.bayern.de,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
1 CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
## TLS Connection Info:
TLS version: TLS1.2
CipherSuite: TLS_RSA_WITH_AES_256_GCM_SHA384
## End-Entity Certificate Info:
X509 version: 1
Serial#: eebc66ec77fe726e
Subject: CN=mail.bayern.de,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
Issuer: CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
Signature Algorithm: SHA256-RSA
PublicKey Algorithm: RSA 2048-Bits
Inception: 2022-01-31 05:27:22 +0000 UTC
Expiration: 2022-03-02 05:27:22 +0000 UTC
KU:
EKU:
SKI:
AKI:
OSCP Servers: []
CA Issuer URL: []
CRL Distribution: []
Policy OIDs: []
Result: FAILED: DANE TLS authentication failed
## Checking mail.bayern.de 195.200.70.104 port 25
DANE TLSA 2 0 1 [32a2bc1d..]: FAIL matched TA certificate at depth 1 but name check failed
## STARTTLS Transcript:
recv: 220 mail115.bayern.de ESMTP Bavarian Mail Gateway; Tue, 1 Feb 2022 16:48:10 +0100
send: EHLO v22019048273988146
recv: 250-mail115.bayern.de Hello, pleased to meet you
recv: 250-ENHANCEDSTATUSCODES
recv: 250-PIPELINING
recv: 250-8BITMIME
recv: 250-SIZE 50000000
recv: 250-DSN
recv: 250-ETRN
recv: 250-STARTTLS
recv: 250-DELIVERBY
recv: 250 HELP
send: STARTTLS
recv: 220 2.0.0 Ready to start TLS
## Peer Certificate Chain:
0 CN=mail.bayern.de,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
1 CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
## Verified Certificate Chain 0:
0 CN=mail.bayern.de,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
1 CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
## TLS Connection Info:
TLS version: TLS1.2
CipherSuite: TLS_RSA_WITH_AES_256_GCM_SHA384
## End-Entity Certificate Info:
X509 version: 1
Serial#: eebc66ec77fe7269
Subject: CN=mail.bayern.de,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
Issuer: CN=Bayerische DANE-CA,O=Freistaat Bayern,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c1e4265686f657264656e6e65747a6469656e7374654062617965726e2e6465
Signature Algorithm: SHA256-RSA
PublicKey Algorithm: RSA 2048-Bits
Inception: 2022-01-31 05:25:08 +0000 UTC
Expiration: 2022-03-02 05:25:08 +0000 UTC
KU:
EKU:
SKI:
AKI:
OSCP Servers: []
CA Issuer URL: []
CRL Distribution: []
Policy OIDs: []
Result: FAILED: DANE TLS authentication failed
[2] Authentication failed for all (2) peers.
I can't see what exactly went wrong. To check I tried mail.bayern.de
with https://dane.sys4.de/ and https://danetools.com/dane?host=mail.bayern.de&service=smtp&port=25&protocol=tcp. Both sites say that everything is ok.
Is this a bug in the gotls program or are the DANE check sites wrong?
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.