wholetrans/docs-matrix-spec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Explain the reasons why <hostname> TLS certificate is needed rather than <delegated_hostname> for SRV delegation. (#3322)

Browse source 
Signed-off-by: Niels Basjes <niels@basjes.nl>
This commit is contained in:
Niels Basjes 2021-08-10 13:51:29 +02:00 • committed by Richard van der Hoff
parent 19a96c2484
commit cf5b519963
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelogs/server_server/newsfragments/3322.clarification Normal file
View file

@ -0,0 +1 @@
Explain the reasons why `<hostname>` TLS certificate is needed rather than `<delegated_hostname>` for SRV delegation.

9
content/server-server-api.md
View file

@ -134,6 +134,15 @@ to send. The process overall is as follows:
8448 and a `Host` header containing the `<hostname>`. The target
server must present a valid certificate for `<hostname>`.
{{% boxes/note %}}
The reasons we require `<hostname>` rather than `<delegated_hostname>` for SRV
delegation are:
1. DNS is insecure (not all domains have DNSSEC), so the target of the delegation
must prove that it is a valid delegate for `<hostname>` via TLS.
2. Consistency with the recommendations in [RFC6125](https://datatracker.ietf.org/doc/html/rfc6125#section-6.2.1)
and other applications using SRV records such [XMPP](https://datatracker.ietf.org/doc/html/rfc6120#section-13.7.2.1).
{{% /boxes/note %}}
The TLS certificate provided by the target server must be signed by a
known Certificate Authority. Servers are ultimately responsible for
determining the trusted Certificate Authorities, however are strongly