stubby: Stubby unable to connect to Cloudflare's 1.1.1.1 (WINDOWS)

echo | openssl s_client -connect '1.1.1.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 returns yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=

So this seems to be working for me:

• address_data: 1.1.1.1 tls_port: 853 tls_auth_name: “cloudflare-dns.com” tls_pubkey_pinset:
  • digest: “sha256” value: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=

resolution_type: GETDNS_RESOLUTION_STUB
dns_transport_list:
  - GETDNS_TRANSPORT_TLS
tls_authentication: GETDNS_AUTHENTICATION_REQUIRED
tls_query_padding_blocksize: 128
edns_client_subnet_private : 1
idle_timeout: 10000
listen_addresses:
  - 127.0.0.1
round_robin_upstreams: 1
upstream_recursive_servers:
  - address_data: 1.1.1.1
    tls_pubkey_pinset:
      - digest: "sha256"
        value: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=

outputs

STUBBY: Read config from file stubby.yml
STUBBY: DNSSEC Validation is OFF
STUBBY: Transport list is:
STUBBY:   - TLS
STUBBY: Privacy Usage Profile is Strict (Authentication required)
STUBBY: (NOTE a Strict Profile only applies when TLS is the ONLY transport!!)
STUBBY: Starting DAEMON....
Could not schedule query: The context has internal deficiencies
STUBBY: 1.1.1.1                                  : Conn opened: TLS - Strict Profile
STUBBY: 1.1.1.1                                  : Verify failed : TLS - *Failure* -  (20) "unable to get local issuer certificate"
STUBBY: 1.1.1.1                                  : Conn closed: TLS - *Failure*
STUBBY:    *FAILURE* no valid transports or upstreams available!
STUBBY: 1.1.1.1                                  : Conn closed: TLS - Resps=     0, Timeouts  =     0, Curr_auth = Failed, Keepalive(ms)=     0
STUBBY: 1.1.1.1                                  : Upstream   : TLS - Resps=     0, Timeouts  =     0, Best_auth = Failed
STUBBY: 1.1.1.1                                  : Upstream   : TLS - Conns=     0, Conn_fails=     1, Conn_shuts=      0, Backoffs     =     0
STUBBY:    *FAILURE* no valid transports or upstreams available!
Could not schedule query: None of the configured upstreams could be used to send queries on the specified transports

So, I guess, it does not work on my end.

Using this works for me:

upstream_recursive_servers:
  - address_data: 1.1.1.1
    tls_port: 853
    tls_auth_name: "cloudflare-dns.com"

@rwfeldmann Thanks for the logs. I looks to me that the version of getdns_query.exe you have is the latest and is working just fine which means that the very latest installer (0.0.4) should also work for you. From the log I believe you still have the 0.0.3 version of Stubby installed - can you re-install the latest version and test Stubby again please?

I’ve created a 0.0.4 installer with a custom fix for this issue - please see if this works. I’ve also opened https://github.com/getdnsapi/getdns/issues/392 to implement a review of this code and a fix for the CA path/file issue for the next release.

Fellows, haste makes waste, stop posting your “it works for me” without carefully reading first. Mr. @jankal stated clearly in the initial post that issue is related to Windows certificates store, which echoes last year still unresolved issue #46. Windows users have different state of certificates store, there are already three non-amateurs here (the author, @george-chakhidze and me), who suffer from this issue not because configuration is wrong, some whitespaces are omitted, or something else, but exactly because Stubby is a fledgling endeavour. And the only valuable feedback would come from Stubby’s maintainers, i.e. a fix.

@jankal This can be another problem, because the relevant part in my config is uncommented. tls_authentication: GETDNS_AUTHENTICATION_REQUIRED. And the log shows as: STUBBY: 1.1.1.1 : Conn opened: TLS - Strict Profile

@t5k6 My method is usually right but failed due to the certificate not being an RSA certificate. So I’m wrong with the sha256-pin

But even when I changed the sha256-pin, the error remains.

Unable to connect to Cloudflare over TLS either. Many other TLS resolvers work fine, Cloudflare’s DoH implementation works fine. So, I guess, there is something wrong with Stubby 0.0.2 for Windows. Please, fix it.

resolution_type: GETDNS_RESOLUTION_STUB
dns_transport_list:
  - GETDNS_TRANSPORT_TLS
tls_authentication: GETDNS_AUTHENTICATION_REQUIRED
tls_query_padding_blocksize: 128
edns_client_subnet_private : 1
idle_timeout: 10000
listen_addresses:
  - 127.0.0.1
round_robin_upstreams: 1
upstream_recursive_servers:
   - address_data: 1.1.1.1
     tls_auth_name: "cloudflare-dns.com"
     tls_port: 853
     tls_pubkey_pinset:
       - digest: "sha256"
         value: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=

or even

   - address_data: 1.1.1.1
     tls_auth_name: "cloudflare-dns.com"

ends up in

STUBBY: 1.1.1.1 : Verify failed : Transport=TLS - *Failure* - (20) "unable to get local issuer certificate"
STUBBY: *FAILURE* no valid transports or upstreams available!