<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 19 Apr 2017, at 07:54, <a href="mailto:xmgao@biigroup.cn" class="">xmgao@biigroup.cn</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span class=""></span><div style="margin: 0cm 0cm 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Hello everyone,<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">I’m Xiaomin, a young engineer in this field. I’m trying to setup a DNS-over-TLS demo using Stubby recently. Now it works in opportunistic mode, but failed in strict mode with<span class="Apple-converted-space"> </span></span><span class="apple-converted-space"><span lang="EN-US" style="font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(51, 51, 51);" class=""> </span></span><span lang="EN-US" style="font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(51, 51, 51);" class="">'tls_authentication: GETDNS_AUTHENTICATION_REQUIRED' field. AFAIK, the server are using Let's encrypt cert, What should I do on client side(stubby) to verify the cert? Do I need make extra configuration on Stubby or openssl?</span><span lang="EN-US" class=""><o:p class=""></o:p></span></div></div></div></blockquote><br class=""></div><div>Hi Xiaomin,</div><div><br class=""></div><div>Thanks for your question. Can you let me know which version of Stubby you are using? I would recommend using the recent 1.1.0 release.</div><div><br class=""></div><div>To validate a nameserver Stubby needs one of</div><div>- an authentication domain name or</div><div>- a SPKI pin</div><div><br class=""></div><div>The easiest way to set up strict authentication is to use the default configuration file that is in the getdns source code in src/tools/stubby.conf which has this information in for several servers. Then tell Stubby where to find this file by using the ‘-C’ flag on the command line. I’ve attached the stubby.conf file here for reference. This configuration will run in Strict mode, using all the servers listed. </div><div><br class=""></div><div>If you want a simple demo then I suggest just using a single server that has a Let’s Encrypt certificate. I’ve created a file for that too using the getdns nameserver and attached it (stubby_one_server.conf). </div><div><br class=""></div><div>Hope this helps</div><div><br class=""></div><div>Regards</div><div><br class=""></div><div>Sara. </div><div><br class=""></div><div><br class=""></div><div><br class=""></div></body></html>