2

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy.

[INFO] + DNS Security Extensions are supported
[INFO] - [dnscrypt.eu-dk] does not support Namecoin domains
[INFO] + Provider supposedly doesn't keep logs
[NOTICE] Starting dnscrypt-proxy 1.6.0
[INFO] Generating a new session key pair
[INFO] Done
[INFO] Server certificate #808464433 received
[INFO] This certificate looks valid
[INFO] Chosen certificate #808464433 is valid from [2015-09-11] to [2016-09-10]
[INFO] Server key fingerprint is 164E:1AD6:4356:777D:2019:F2F9:D389:2DDB:BC75:8AF0:9172:8E0C:A874:10C7:3BE8:423B

The part that I think is suspicious, is this:

[INFO] This certificate looks valid

It sounds like the dnscrypt-proxy have doubts about how valid the certificate is. What happens to the absolute state of valid? Either it is a valid certificate or not.

Have I done something wrong with the configuration?

Configuration file (Resolver part):

DNSCRYPT_PROXY_PROVIDER_KEY=3748:5585:E3B9:D088:FD25:AD36:B037:01F5:520C:D648:9E9A:DD52:1457:4955:9F0A:9955
DNSCRYPT_PROXY_PROVIDER_NAME=2.dnscrypt-cert.resolver2.dnscrypt.eu 
DNSCRYPT_PROXY_RESOLVER_ADDRESS=77.66.84.233:443
DNSCRYPT_PROXY_RESOLVER_NAME=dnscrypt.eu-dk

init.d script (start part):

if start_daemon -p "${DNSCRYPT_PROXY_PIDFILE}" ${DNSCRYPT_PROXY_BIN} \
    --pidfile "${DNSCRYPT_PROXY_PIDFILE}" \
    --daemonize \
    --ephemeral-keys \
    --user="${DNSCRYPT_PROXY_USER}" \
    --local-address="${DNSCRYPT_PROXY_LOCAL_ADDRESS}" \
    --provider-key="${DNSCRYPT_PROXY_PROVIDER_KEY}" \
    --provider-name="${DNSCRYPT_PROXY_PROVIDER_NAME}" \
    --resolver-name="${DNSCRYPT_PROXY_RESOLVER_NAME}" \
    --resolver-address="${DNSCRYPT_PROXY_RESOLVER_ADDRESS}" \
    --logfile="${DNSCRYPT_PROXY_LOG_FILE}" \
    $DNSCRYPT_PROXY_OPTIONS; then

The internal dataflow is as follow:

| DNS Client -> DNSMasq (+ DNSSEC) -> DNSCrypt-proxy | -> | LAN/Internet |
+----------------------------------------------------+----+--------------+
|                    Internal                        |    |    Network   |
2

It is valid.

See this change in the developement tree.

That said, your configuration should be simplified. When using a predefined resolver, all you need is the resolver name:

DNSCRYPT_PROXY_RESOLVER_NAME=dnscrypt.eu-dk

It doesn't make any sense to provide the name of a predefined resolver and then manually override everything. Worse, it will break if the certificate parameters change.

Just remove DNSCRYPT_PROXY_PROVIDER_KEY, DNSCRYPT_PROXY_PROVIDER_NAME and DNSCRYPT_PROXY_RESOLVER_ADDRESS. These are only useful when you are running your own DNSCrypt server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.