How to use setting under Unbound:"Verfiy if CN in certficate matches"

[ryp43]

Would like to know what shall be entered under the setting under Unbound: "Verfiy if CN in certficate matches" for Cloudflare DNS?

Also, the setting is terribly misspelled.

[ryp43]

Figured it out - it's CNAME of a DNS server. For Cloudflare, it's 'one.one.one.one'

[franco]

Not entirely the CNAME in the DNS sense, but rather the hostname to verify in the SSL certificate.

https://github.com/opnsense/core/commit/d824e7163b0


Cheers,
Franco

[ryp43]

Sorry, for calling it "terrible". but you missed the "certificate" misspelling

[franco]

No problem at all. Missed this one. Thanks again!

https://github.com/opnsense/core/commit/25b98610


Cheers,
Franco

[mnaim]

Based on this https://developers.cloudflare.com/1.1.1.1/dns-over-tls
cloudflare-dns.com is correct CN in certificate

[hushcoden]

1.1.1.1 / 1.0.0.1  <--> cloudflare-dns.com

Block malware:
1.1.1.2 / 1.0.0.2  <--> security.cloudflare-dns.com

EDIT:
Block malware and adult content:
1.1.1.3 / 1.0.0.3  <--> family.cloudflare-dns.com

[adk20]

This setting prevents unbound from starting on my box:

1.1.1.3 / 1.0.0.3  <--> security.cloudflare-dns.com

Any idea what other CN I could try?

Thanks a heap!

EDIT
family.cloudflare-dns.com seems to work. However, unbound failed to start automatically but required a manual restart after adding the DoT CN.
/EDIT

[hushcoden]

Thanks adk20, I've amended my post 

[GiantJack]

Hi !
May I ask how to check if the provided "verify CN" works fine ?
I tried to figure out what to use with quad9...I found it may be dns.quad9.net...can I confirm this with opnsense logs or something?

[Gary7]

I took a look at the cloudflare.com SSL certificates.
Here is the list of addresses, Common Names, and Subject Alternative Names (SAN)

Cloudflare SSL certificates

Addresses: 1.1.1.1  &  1.0.0.1
Common name: cloudflare-dns.com
                SAN: DNS Name=cloudflare-dns.com
                        DNS Name=*.cloudflare-dns.com
                        DNS Name=one.one.one.one
                        IP Address=1.1.1.1
                        IP Address=1.0.0.1
                        IP Address=162.159.36.1
                        IP Address=162.159.46.1
                        IP Address=2606:4700:4700:0000:0000:0000:0000:1111
                        IP Address=2606:4700:4700:0000:0000:0000:0000:1001
                        IP Address=2606:4700:4700:0000:0000:0000:0000:0064
                        IP Address=2606:4700:4700:0000:0000:0000:0000:6400


Addresses:  1.1.1.2  &  1.0.0.2
Common name: security.cloudflare-dns.com
                SAN: IP Address=2606:4700:4700:0000:0000:0000:0000:1112
                        IP Address=2606:4700:4700:0000:0000:0000:0000:1002
                        DNS Name=security.cloudflare-dns.com
                        DNS Name=*.security.cloudflare-dns.com
                        IP Address=1.1.1.2
                        IP Address=1.0.0.2

Addresses:  1.1.1.3  &  1.0.0.3
Common name: family.cloudflare-dns.com
                SAN: IP Address=2606:4700:4700:0000:0000:0000:0000:1113
                        IP Address=2606:4700:4700:0000:0000:0000:0000:1003
                        DNS Name=family.cloudflare-dns.com
                        DNS Name=*.family.cloudflare-dns.com
                        IP Address=1.1.1.3
                        IP Address=1.0.0.3

[ryp43]

Thanks, wasn't aware of these 4

IP Address=162.159.36.1
IP Address=162.159.46.1
IP Address=2606:4700:4700:0000:0000:0000:0000:0064
IP Address=2606:4700:4700:0000:0000:0000:0000:6400

https://ssl-tools.net/webservers/cloudflare-dns.com