Confirmed users
308
edits
Security/DNSSEC-TLS-nginx: Difference between revisions
Jump to navigation
Jump to search
no edit summary
mNo edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
This page details how to set up a | This page details how to set up a server running a modified version of nginx that uses a self-signed certificate with the DNSSEC TLS extension to authenticate https sessions. It's probably safest to do this in a virtual machine. However, for the brave, simply skip the VM-specific steps. | ||
# Set up a linux VM and enable a host-only network adapter so you can talk to it as well as a NAT'd adapter so it can talk to the internet (outside the scope of this article) | # Set up a linux VM and enable a host-only network adapter so you can talk to it as well as a NAT'd adapter so it can talk to the internet (outside the scope of this article) | ||
| Line 5: | Line 5: | ||
# Install and set up bind9: | # Install and set up bind9: | ||
## 'apt-get install bind' or bind9 or something | ## 'apt-get install bind' or bind9 or something | ||
## Set up keys and zone files (see [https://www.dnssec-tools.org/wiki/index.php/Sign_Your_Zone here], except using dnssec-keygen and dnssec-signzone instead of zonesigner) | ## Set up keys and zone files (see [https://www.dnssec-tools.org/wiki/index.php/Sign_Your_Zone here], except using dnssec-keygen and dnssec-signzone instead of zonesigner). This will involve getting your DS set signed by your zone's parent. | ||
## Make a self-signed certificate | ## Make a self-signed certificate | ||
## Make a TLSA record using [http://hg.mozilla.org/users/dkeeler_mozilla.com/dnssec-tls/file/tip/cert2dane.sh cert2tlsa.sh] (and put this in your zone file) | ## Make a TLSA record using [http://hg.mozilla.org/users/dkeeler_mozilla.com/dnssec-tls/file/tip/cert2dane.sh cert2tlsa.sh] (and put this in your zone file) | ||
## Sign the zones | ## Sign the zones | ||
## Start the server | ## Start the dns server | ||
# Get sources: | # Get sources: | ||
## [http://www.nlnetlabs.nl/downloads/ldns/ldns-1.6.10.tar.gz ldns-1.6.10.tar.gz] | ## [http://www.nlnetlabs.nl/downloads/ldns/ldns-1.6.10.tar.gz ldns-1.6.10.tar.gz] | ||
| Line 21: | Line 21: | ||
## Run './configure --disable-gost --prefix=$HOME/local' | ## Run './configure --disable-gost --prefix=$HOME/local' | ||
## Run 'make', 'make install' | ## Run 'make', 'make install' | ||
## (If you prefer, simply build it without installing and link against the static libs when necessary.) | |||
# Use [http://hg.mozilla.org/users/dkeeler_mozilla.com/dnssec-tls/file/tip/generate.c generate.c] to make a dnssec chain | # Use [http://hg.mozilla.org/users/dkeeler_mozilla.com/dnssec-tls/file/tip/generate.c generate.c] to make a dnssec chain | ||
# Unpack and patch a local copy of openssl: | # Unpack and patch a local copy of openssl: | ||
## Untar the archive and cd to the directory | ## Untar the archive and cd to the directory | ||
## Apply the patch | ## Apply the patch | ||
## You don't actually have to config/compile/install (nginx does | ## You don't actually have to config/compile/install (nginx just does what it needs with this openssl directory) | ||
# Build nginx: | # Build nginx: | ||
## Untar the archive and cd to the directory | ## Untar the archive and cd to the directory | ||