fedora-infrastructure

#10933 DANE record does not match on fedoraproject.org
Closed: Fixed by kevin. Opened by pemensik.

Closed: Fixed
Reopen Issue

danetool --check fedoraproject.org fails. It seems certificates are not updated also in DNS.

Describe what you would like us to do:

Fix TLSA record in fedoraproject.org zone.

$ danetool --check fedoraproject.org
Resolving 'fedoraproject.org:https'...
Obtaining certificate from '18.159.254.57:443'...
Querying DNS for fedoraproject.org (tcp:443)...
_443._tcp.fedoraproject.org. IN TLSA ( 00 00 01 19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0 )
Certificate usage: CA (00)
Certificate type:  X.509 (00)
Contents:     SHA2-256 hash (01)
Data:         19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0
Verification: Verification failed. CA constrains were violated.

Example of passing site:

$ danetool --check nlnetlabs.nl
Resolving 'nlnetlabs.nl:https'...
Obtaining certificate from '185.49.140.10:443'...
Querying DNS for nlnetlabs.nl (tcp:443)...
_443._tcp.nlnetlabs.nl. IN TLSA ( 03 01 01 544f284d66af2de08c17e7486aedfa2e00aa1ac6bbf3af5ca62b55ab7ac269be )
Certificate usage: Local end-entity (03)
Certificate type:  SubjectPublicKeyInfo (01)
Contents:     SHA2-256 hash (01)
Data:         544f284d66af2de08c17e7486aedfa2e00aa1ac6bbf3af5ca62b55ab7ac269be
Verification: Certificate matches.

When do you need this to be done by? (YYYY/MM/DD)

No date, the sooner the better.

Metadata Update from @phsmoura:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: medium-gain, medium-trouble, ops

Updated. Can you confirm all looks well?

Yes, it passes now.

$ danetool --check fedoraproject.org
Resolving 'fedoraproject.org:https'...
Obtaining certificate from '140.211.169.196:443'...
Querying DNS for fedoraproject.org (tcp:443)...
_443._tcp.fedoraproject.org. IN TLSA ( 01 01 01 a268847da80175457baf603df3b0ab9cc99d1f6bb84b83c351f97e9e6f397bb4 )
Certificate usage: End-entity (01)
Certificate type:  SubjectPublicKeyInfo (01)
Contents:     SHA2-256 hash (01)
Data:         a268847da80175457baf603df3b0ab9cc99d1f6bb84b83c351f97e9e6f397bb4
Verification: Certificate matches.

Thanks.

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

medium-gain medium-trouble ops

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.