<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Xiaomin, <div class=""><br class=""></div><div class="">Thanks for the reply and the log output. I suspect that the version of OpenSSL you are using is quite old? You need version 1.0.1 or later for TLS support and version 1.0.2 or later is required for TLS hostname authentication. This message is output if the version is less than 1.0.2. </div><div class=""><br class=""></div><div class="">Regards</div><div class=""><br class=""></div><div class="">Sara. </div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 19 Apr 2017, at 10:36, <a href="mailto:xmgao@biigroup.cn" class="">xmgao@biigroup.cn</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span class=""></span>Hi Sara,</div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Thanks for your advice. I followed your instructions : update stubby to 1.1.0 version and rebuild it. I use the <span style="font-size: 10.5pt; line-height: 1.5; background-color: window;" class="">stubby_one_server.conf as you suggested. But I still encounter the same problem. I print the error msg as follows:</span></div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;" class=""><br class=""></span></div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span microsoft="" yahei="" ui'";="" font-size:="" 14px;="" color:="" rgb(0,="" 0,="" 0);="" background-color:="" rgb(255,="" 255,="" 255);="" font-weight:="" normal;="" font-style:="" normal;text-decoration:="" none;'="" style="font-family: '';" class="">[09:29:08.290308] => ENTRY: _getdns_submit_stub_request : MSG: 0x9122658 TYPE: 1<br class="">[09:29:08.290426] --- SETUP: upstream_select_stateful : Testing upstreams 0 0<br class="">[09:29:08.290436] --- SETUP: upstream_select_stateful : Testing upstreams 1 0<br class="">[09:29:08.290443] --- SETUP: upstream_connect : Getting upstream connection: 0x9121fec<br class="">[09:29:08.290448] --- SETUP: tcp_connect : Creating TCP connection: 0x9121fec<br class="">[09:29:08.290776] --- SETUP(TLS): tls_create_object : Hostname verification requested for: <a href="http://getdnsapi.net/" class="">getdnsapi.net</a><br class="">[09:29:08.290790] --- SETUP(TLS): tls_create_object : <font color="#ff0000" class="">ERROR: TLS Authentication functionality not available</font><br class="">[09:29:08.290802] --- CLEANUP: upstream_failed : FD: 5 Failure during connection setup = 1<br class="">[09:29:08.290822] --- SETUP: upstream_select_stateful : Testing upstreams 0 0<br class="">[09:29:08.290827] --- SETUP: upstream_select_stateful : Testing upstreams 1 3<br class="">[09:29:08.290832] ----- SCHEDULE: upstream_find_for_netreq : MSG: 0x9122658 No valid upstream! <br class="">[09:29:08.290840] GETDNS_DAEMON: *FAILURE* no valid transports or upstreams available!<br class="">Could not schedule query: None of the configured upstreams could be used to send queries on the specified transports<br class=""></span></div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Regards,</div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Xiaomin</div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><hr size="1" align="left" style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; width: 210px; height: 1px;" class=""><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span class=""><div style="margin: 10px; font-family: verdana; font-size: 10pt;" class=""><div class=""><a href="mailto:xmgao@biigroup.cn" class="">xmgao@biigroup.cn</a></div></div></span></div><blockquote style="margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""> </div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" class=""><div style="padding: 8px; font-size: 12px; font-family: tahoma; background-color: rgb(239, 239, 239);" class=""><div class=""><b class="">From:</b> <a href="mailto:sara@sinodun.com" class="">Sara Dickinson</a></div><div class=""><b class="">Date:</b> 2017-04-19 16:34</div><div class=""><b class="">To:</b> <a href="mailto:users@getdnsapi.net" class="">libgetdns users list</a></div><div class=""><b class="">Subject:</b> Re: [getdns-users] A question on stubby</div></div></div><div class=""><div class="FoxDiv20170419173032055200" style="word-wrap: break-word; -webkit-line-break: after-white-space;"><br class=""><div class=""><blockquote type="cite" class="" style="margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em;"><div class="">On 19 Apr 2017, at 07:54,<span class="Apple-converted-space"> </span><a href="mailto:xmgao@biigroup.cn" class="">xmgao@biigroup.cn</a><span class="Apple-converted-space"> </span>wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="" style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span class=""></span><div class="" style="margin: 0cm 0cm 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">Hello everyone,<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div class="" style="margin: 0cm 0cm 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif;"><span lang="EN-US" class="">I’m Xiaomin, a young engineer in this field. I’m trying to setup a DNS-over-TLS demo using Stubby recently. Now it works in opportunistic mode, but failed in strict mode with<span class="Apple-converted-space"> </span></span><span class="apple-converted-space"><span lang="EN-US" class="" style="font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(51, 51, 51);"> </span></span><span lang="EN-US" class="" style="font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(51, 51, 51);">'tls_authentication: GETDNS_AUTHENTICATION_REQUIRED' field. AFAIK, the server are using Let's encrypt cert, What should I do on client side(stubby) to verify the cert? Do I need make extra configuration on Stubby or openssl?</span><span lang="EN-US" class=""><o:p class=""></o:p></span></div></div></div></blockquote><br class=""></div><div class="">Hi Xiaomin,</div><div class=""><br class=""></div><div class="">Thanks for your question. Can you let me know which version of Stubby you are using? I would recommend using the recent 1.1.0 release.</div><div class=""><br class=""></div><div class="">To validate a nameserver Stubby needs one of</div><div class="">- an authentication domain name or</div><div class="">- a SPKI pin</div><div class=""><br class=""></div><div class="">The easiest way to set up strict authentication is to use the default configuration file that is in the getdns source code in src/tools/stubby.conf which has this information in for several servers. Then tell Stubby where to find this file by using the ‘-C’ flag on the command line. I’ve attached the stubby.conf file here for reference. This configuration will run in Strict mode, using all the servers listed. </div><div class=""><br class=""></div><div class="">If you want a simple demo then I suggest just using a single server that has a Let’s Encrypt certificate. I’ve created a file for that too using the getdns nameserver and attached it (stubby_one_server.conf). </div><div class=""><br class=""></div><div class="">Hope this helps</div><div class=""><br class=""></div><div class="">Regards</div><div class=""><br class=""></div><div class="">Sara. </div></div></div></blockquote></div></blockquote></div><br class=""></div></body></html>