[3 BTC Bounty] TLS Support for .bit Domains

[khal]

Here is version 0.10 :
http://dot-bit.org/files/Convergence.xpi

Changes :
- fixed lowercase fingerprints
- added automatic update from http://dot-bit.org/

The ID of the plugin has changed, so you need to remove the old Convergence plugin if you already have it.


ps : firefox plugins must be signed for automatic updates to work. So, each release I make are signed with my private key and firefox verify it.

[phelix]

Setting TLS up with nginx went pretty smoothly. To test I simply load modified data into nmcontrol. Also I use the nmcontrol built in dns server (via acrylic dns proxy).

I generated the certificate like this:
openssl req -new -x509 -nodes -out server.crt -keyout server.key
(from http://dracoblue.net/dev/https-nginx-wi ... icate/188/)

For "Common Name" I entered the domainname and tld of my testdomain: nmctls.bit - is that right? Besides that I simply hit enter all the time. NGiNX digests the certificate and I can browse by adding an exception to regular firefox.

I created the fingerprint like this:
openssl x509 -in server.crt -sha1 -noout -fingerprint

But now I ran into some problem: Invalid Certificate / ssl_error_bad_cert_domain

Any ideas?

Here is version 0.10 :
http://dot-bit.org/files/Convergence.xpi

Changes :
- fixed lowercase fingerprints
- added automatic update from http://dot-bit.org/

The ID of the plugin has changed, so you need to remove the old Convergence plugin if you already have.

What about automatically updating nmcontrol database, too? As a lightweight .bit support with dot-bit authority TLS system.

[phelix]

It just occurred to me I had not yet restarted nginx... it's working now.






biolizard89, please pm me btc and nmc addresses and info on which domains you would like.

note: this is not a public domain

[khal]

note: this is not a public domain

If people want to test, this one is configured : https://dot-bit.bit/Main_Page

Does it work for you ?


(edit: for info, the IP of your domain need to return the same certificate for now. As SNI support is broken, it'll only look for the certificate for the ip [the default certificate configured for example], not the domain)

[biolizard89]

It just occurred to me I had not yet restarted nginx... it's working now.






biolizard89, please pm me btc and nmc addresses and info on which domains you would like.

note: this is not a public domain

PM sent.

[khal]

What about automatically updating nmcontrol database, too? As a lightweight .bit support with dot-bit authority TLS system.

If added the possility to read names from a file instead of namecoind, in v0.8 I guess.
On linux, simply do "namecoin name_list > data/namecoin.dat", and change the file "conf/plugin-data.conf" :

Code: Select all

import.from = file
import.file = data/namecoin.dat

I also planned to enable update from namecoin (or an url ?) and export it to the same file (data/namecoin.dat)

Is what you mean ?

[phelix]

Maybe the spec should be changed to hold the fingerprint in another format.

I can see the blockchain being filled up with colons : :: : : : : : :


btw: bounty sent

[phelix]

What about automatically updating nmcontrol database, too? As a lightweight .bit support with dot-bit authority TLS system.

If added the possility to read names from a file instead of namecoind, in v0.8 I guess.
On linux, simply do "namecoin name_list > data/namecoin.dat", and change the file "conf/plugin-data.conf" :

Code: Select all

import.from = file
import.file = data/namecoin.dat

yeah, that is what I used to modify the domain data. very handy.

I also planned to enable update from namecoin (or an url ?) and export it to the same file (data/namecoin.dat)

Is what you mean ?

I meant from an url to have a lightweight system working without namecoind.

Would it be possible to transmit the fingerprint from a namecoin dns server to nmcontrol together with the dns request? That would be interesting, too. De facto you would make your dns server your certificate authoritayh. Admittedly not so safe.

A pity DNSSEC is not available yet in browsers or we could simply use that instead of the plugin.

[phelix]

note: this is not a public domain

If people want to test, this one is configured : https://dot-bit.bit/Main_Page

Does it work for you ?

like a charm

(edit: for info, the IP of your domain need to return the same certificate for now. As SNI support is broken, it'll only look for the certificate for the ip [the default certificate configured for example], not the domain)

I don't understand what you are saying.

[biolizard89]

Maybe the spec should be changed to hold the fingerprint in another format.

I can see the blockchain being filled up with colons : :: : : : : : :


btw: bounty sent

Thanks, bounty received.