search

sftcd / wkesni

A well-known URI for publishing ESNIKeys
7 stars 2 forks source link

test URLs, and alias mode in particular... #11

Closed sftcd closed 3 months ago

sftcd commented 1 year ago

I think it's good that we say that the ZF should (or may) test that ECH works before publishing an HTTPS/SVCB RR for a name. In most cases, but maybe not all, that can be done by accessing the landing page for $ORIGIN and verifying that ECH worked and we got an HTTP 200 response (or maybe we'd also allow other HTTP response codes, e.g. a 40x?). But is there a better way to do/phrase that?

I'm also wondering what to verify if $ORIGIN says to use aliasMode - I guess the checking ECH works at the same URL (whatever that may be) for any ECHConfig is enough? (But worth pondering I guess....)

bemasc commented 1 year ago

I think it's the same thing in alias mode: check that the origin is accessible when using the new zone contents.

I think "ECH works" is a bit vague. We probably want an error if the zone would become unreachable, vs. a warning if ECH fallback mode is triggered.

sftcd commented 3 months ago

I think we can close this one based on the current text we have. Agreed?

bemasc commented 3 months ago

Seems to be covered here: https://github.com/sftcd/wkesni/blob/5a19f64c4ada709e3a70eda28af9298798d7b92d/draft-ietf-tls-wkech.xml#L433