Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
buffrr committed Feb 25, 2024
1 parent a3ed573 commit e28059c
Showing 1 changed file with 0 additions and 59 deletions.
59 changes: 0 additions & 59 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,17 +8,6 @@

Let's DANE enables the use of [DANE (DNS Based Authentication of Named Entities)](https://tools.ietf.org/html/rfc6698) in browsers and other apps using a lightweight proxy. It currently supports DANE-EE and works with self-signed certificates.

<p align="center">
<br>
<br>
<img src="https://user-images.githubusercontent.com/41967894/117558135-46a37100-b02f-11eb-8bda-80d26b7acba2.png" width="450px" alt="Let's DANE Handshake"/>
</p>

<p align="center">
This domain is DNSSEC signed with <a href="https://ed25519.nl/">ed25519</a> in an experimental decentralized alternate root zone, handshake.org.
<br><br>
</p>

<p align="center">
<img src="https://user-images.githubusercontent.com/41967894/117558143-5fac2200-b02f-11eb-8222-5dc41033b3f4.png" width="450px" alt="Let's DANE verified DNSSEC"/><br/>

Expand Down Expand Up @@ -70,54 +59,6 @@ If letsdane is compiled with libunbound, all queries are DNSSEC validated with a

Use `letsdane -help` to see command line options.

## Using with Handshake root zone

Currently, there are two ways to use letsdane with Handshake:

### 1. Using hsd/hnsd (recommended)

You can use [hsd](https://github.com/handshake-org/hsd) or [hnsd](https://github.com/handshake-org/hnsd). Specify address:port of the handshake resolver. You must have it local on your machine or use sig0.

Optionally use `-skip-icann` to skip TLSA lookups for ICANN tlds and prevent the generated CA from issuing certificates for ICANN tlds (recommended hnsd is still experimental and also this will not break some legacy domains using poorly configured nameservers).

Assuming hnsd is listening on '127.0.0.1:5350'

letsdane -r 127.0.0.1:5350 -skip-dnssec -skip-icann

- Add Let's DANE proxy to your web browser `127.0.0.1:8080` ([Firefox example](https://user-images.githubusercontent.com/41967894/117558156-8f5b2a00-b02f-11eb-98ba-91ce8a9bdd4a.png))

- Import the certificate file into your browser certificate store ([Firefox example](https://user-images.githubusercontent.com/41967894/117558164-a7cb4480-b02f-11eb-93ed-678f81f25f2e.png)). You can use `letsdane -o myca.crt` to export the public cert file to a convenient location.

If you use hsd, you can optionally use sig0 by specifying the public key `public_key@ip:port`

letsdane -r aj7bjss4ae6hd3kdxzl4f6klirzla377uifxu5mnzczzk2v7p76ek@192.168.1.22:5350 -skip-icann

Firefox creates a separate CA store for each profile, so it's recommended to use that if you want the CA to only be trusted by a specific profile.

### 2. Using DoH

You can use any DoH resolver **that you trust**. The resolver must support Handshake if you want Handshake domains to work.

```
letsdane -r https://easyhandshake.com:8053 -skip-dnssec -skip-icann
```

- Add Let's DANE proxy to your web browser `127.0.0.1:8080` ([Firefox example](https://user-images.githubusercontent.com/41967894/117558156-8f5b2a00-b02f-11eb-98ba-91ce8a9bdd4a.png))

- Import the certificate file into your browser certificate store ([Firefox example](https://user-images.githubusercontent.com/41967894/117558164-a7cb4480-b02f-11eb-93ed-678f81f25f2e.png)). You can use `letsdane -o myca.crt` to export the public cert file to a convenient location.

### DANE-EE Sites

- FreeBSD: <https://freebsd.org>
- Tor Project: <https://torproject.org>

handshake

- <https://3b>
- <https://letsdane>
- <https://proofofconcept>
- <https://humbly>

### DANE Tools

- danectl: <https://raf.org/danectl> (helper tool for certbot & letsencrypt)
Expand Down

0 comments on commit e28059c

Please sign in to comment.