search

AdguardTeam / DnsLibs

DNS filtering library that's used in AdGuard products
https://adguard.com/
Apache License 2.0
99 stars 20 forks source link

sdns:// cert pinning is incorrect #205

Closed sfionov closed 1 year ago

sfionov commented 1 year ago

We now calculate hash of certificate: echo | openssl s_client -connect 94.140.14.14:853 -servername dns.adguard-dns.com 2>/dev/null | openssl x509 -outform der | sha256sum

But in SDNS stamp spec it is TBSCertificate (1st member of Certificate structure), not just Certificate. echo | openssl s_client -connect 94.140.14.14:853 -servername dns.adguard-dns.com 2>/dev/null | openssl x509 -outform der | openssl asn1parse -inform der -strparse +4 -noout -out - | sha256sum