X
Tippen Sie hierhin, um die Version dieser Website für Mobilgeräte aufzurufen.

Hilfeforum

DoH and client authentication

Veröffentlicht

I’m trying to use my own DoH server with Firefox. It works fine basically but if I enable client authentication on it, DoH seems to fail. Since It’s difficult to create ip address based access filtering for remote mobile users, I want to add some user authentication feature to my DoH session.

Does current DoH client of Firefox support “TLS client certificate” or “HTTP header” authentication?

I’m trying to use my own DoH server with Firefox. It works fine basically but if I enable client authentication on it, DoH seems to fail. Since It’s difficult to create ip address based access filtering for remote mobile users, I want to add some user authentication feature to my DoH session. Does current DoH client of Firefox support “TLS client certificate” or “HTTP header” authentication?
Zitieren

Mehr Details zum System

Anwendung

  • User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Mobile/15E148 Safari/604.1

Weitere Informationen

Veröffentlicht

Fragesteller

1. From packet dump in my environment, Firefox DoH client sent no client certificate back to the DoH server.

  1. DoH Session

Secure Sockets Layer

   TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages
       Content Type: Handshake (22)
       Version: TLS 1.2 (0x0303)
       Length: 44
       Handshake Protocol: Certificate
           Handshake Type: Certificate (11)
           Length: 3
           Certificates Length: 0  <<===== NULL
       :
       :
  1. Normal session (from firefox URL bar)

Secure Sockets Layer

   TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages
       Content Type: Handshake (22)
       Version: TLS 1.2 (0x0303)
       Length: 1913
       Handshake Protocol: Certificate
           Handshake Type: Certificate (11)
           Length: 1352
           Certificates Length: 1349   <<===== (valid client certificate)
          :
          :

2. Regarding HTTP header auth, DoH server (nginx on frontend) generated logs something like "no user/password was provided for basic authentication"....


Does anyone have tried to authenticate Firefox DoH user to prevent your DoH server from being an open resolver?

1. From packet dump in my environment, Firefox DoH client sent no client certificate back to the DoH server. # DoH Session Secure Sockets Layer TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 44 Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 3 Certificates Length: 0 <<===== NULL : : # Normal session (from firefox URL bar) Secure Sockets Layer TLSv1.2 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) Version: TLS 1.2 (0x0303) Length: 1913 Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 1352 Certificates Length: 1349 <<===== (valid client certificate) : : 2. Regarding HTTP header auth, DoH server (nginx on frontend) generated logs something like "no user/password was provided for basic authentication".... Does anyone have tried to authenticate Firefox DoH user to prevent your DoH server from being an open resolver?
Hat Ihnen das weitergeholfen?
Zitieren
WestEnd
  • Top 25 Contributor
60 Lösungen 5366 Antworten
Veröffentlicht

Is this something your own making or from whom software/hardware are you using this from? If not yours did you contact their support on this issue since firefox AFAIK isn't a server software?

Is this something your own making or from whom software/hardware are you using this from? If not yours did you contact their support on this issue since firefox AFAIK isn't a server software?

Geändert am von WestEnd

Hat Ihnen das weitergeholfen?
Zitieren
Stellen Sie eine Frage

Sie müssen sich mit Ihrem Benutzerkonto anmelden, um auf Beiträge zu antworten. Bitte stellen Sie eine neue Frage, wenn Sie noch kein Benutzerkonto haben.