2

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy.

[INFO] + DNS Security Extensions are supported
[INFO] - [dnscrypt.eu-dk] does not support Namecoin domains
[INFO] + Provider supposedly doesn't keep logs
[NOTICE] Starting dnscrypt-proxy 1.6.0
[INFO] Generating a new session key pair
[INFO] Done
[INFO] Server certificate #808464433 received
[INFO] This certificate looks valid
[INFO] Chosen certificate #808464433 is valid from [2015-09-11] to [2016-09-10]
[INFO] Server key fingerprint is 164E:1AD6:4356:777D:2019:F2F9:D389:2DDB:BC75:8AF0:9172:8E0C:A874:10C7:3BE8:423B

The part that I think is suspicious, is this:

[INFO] This certificate looks valid

It sounds like the dnscrypt-proxy have doubts about how valid the certificate is. What happens to the absolute state of valid? Either it is a valid certificate or not.

Have I done something wrong with the configuration?

Configuration file (Resolver part):

DNSCRYPT_PROXY_PROVIDER_KEY=3748:5585:E3B9:D088:FD25:AD36:B037:01F5:520C:D648:9E9A:DD52:1457:4955:9F0A:9955
DNSCRYPT_PROXY_PROVIDER_NAME=2.dnscrypt-cert.resolver2.dnscrypt.eu 
DNSCRYPT_PROXY_RESOLVER_ADDRESS=77.66.84.233:443
DNSCRYPT_PROXY_RESOLVER_NAME=dnscrypt.eu-dk

init.d script (start part):

if start_daemon -p "${DNSCRYPT_PROXY_PIDFILE}" ${DNSCRYPT_PROXY_BIN} \
    --pidfile "${DNSCRYPT_PROXY_PIDFILE}" \
    --daemonize \
    --ephemeral-keys \
    --user="${DNSCRYPT_PROXY_USER}" \
    --local-address="${DNSCRYPT_PROXY_LOCAL_ADDRESS}" \
    --provider-key="${DNSCRYPT_PROXY_PROVIDER_KEY}" \
    --provider-name="${DNSCRYPT_PROXY_PROVIDER_NAME}" \
    --resolver-name="${DNSCRYPT_PROXY_RESOLVER_NAME}" \
    --resolver-address="${DNSCRYPT_PROXY_RESOLVER_ADDRESS}" \
    --logfile="${DNSCRYPT_PROXY_LOG_FILE}" \
    $DNSCRYPT_PROXY_OPTIONS; then

The internal dataflow is as follow:

| DNS Client -> DNSMasq (+ DNSSEC) -> DNSCrypt-proxy | -> | LAN/Internet |
+----------------------------------------------------+----+--------------+
|                    Internal                        |    |    Network   |

1 Answer 1

3

It is valid.

See this change in the developement tree.

That said, your configuration should be simplified. When using a predefined resolver, all you need is the resolver name:

DNSCRYPT_PROXY_RESOLVER_NAME=dnscrypt.eu-dk

It doesn't make any sense to provide the name of a predefined resolver and then manually override everything. Worse, it will break if the certificate parameters change.

Just remove DNSCRYPT_PROXY_PROVIDER_KEY, DNSCRYPT_PROXY_PROVIDER_NAME and DNSCRYPT_PROXY_RESOLVER_ADDRESS. These are only useful when you are running your own DNSCrypt server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .