Error using DOQ or DTLS as protocol in resolvers: CRYPTO_ERROR 0x12a (local): tls: failed to verify certificate: x509...

[Fijxu]

For some strange reason, after updating routedns, now I get this error and I can't resolve any domain using DoQ or DTLS:

level=error msg="failed to resolve" addr="127.0.0.1:53" client=127.0.0.1 error="CRYPTO_ERROR 0x12a (local): tls: failed to verify certificate: x509: cannot validate certificate for 37.252.251.157 because it doesn't contain any IP SANs"

(37.252.251.157 is the NextDNS DNS server`)

This is my very simple config, it doesn't have anything important on it:

[bootstrap-resolver]
address = "1.1.1.1:853"
protocol = "dot"

[resolvers.nextdns]
address = "dns.nextdns.io:853"
protocol = "doq"

# This will cache results
[groups.cache]
type = "cache"
resolvers = ["nextdns"]
backend = {type = "memory", size = 1000}
cache-negative-ttl = 300
cache-answer-shuffle = "round-robin"

[listeners.local-udp]
address = "127.0.0.1:53"
protocol = "udp"
resolver = "cache"

Before updating (I don't remember the commit) it worked without any problems. I tried https://github.com/AdguardTeam/dnsproxy using a similar config, using dns.nextdns.io:853 as DoQ resolver and it resolves as intended. Any clues? Thanks in advance.

[cbuijs]

Had this as well and went away after I added server-name to the resolver section. Use the same hostname as in the address.

[folbricht]

This does look like a bug, probably happened when the QUIC library was updated in #323

[folbricht]

There was a change in the upstream quic library. I put a fix on the issue-327 branch if you want to try it out.

[Fijxu]

There was a change in the upstream quic library. I put a fix on the issue-327 branch if you want to try it out.

Now works perfectly without any problems when connecting to a DoQ Server. I will not close this issue until this is pushed to master branch ;)

[charlieporth1]

@Fijxu just to confirm you have tested this branch. If you have. I will add myself to review and review it so it can be merged asap

[Fijxu]

@Fijxu just to confirm you have tested this branch. If you have. I will add myself to review and review it so it can be merged asap

Yes, I tested it and it has been working for hours (because I use routedns as DNS resolver on my personal laptop)