Limits of TLS certificate validation in Consul DNS proxy for upstream DNS‑over‑TLS

Answer

Consul’s DNS proxy does not expose a configuration option such as ca_file or verify_upstream to enable or customize TLS certificate validation for DNS‑over‑TLS (DoT) upstream resolvers. Validation is always performed using the host’s default trust store and cannot be disabled via Consul settings.

Confirmed facts

• The proxy relies on the system’s root CA bundle; it does not accept a custom CA file or certificate pinning for upstream DoT connections.
• Hostname verification is mandatory: the DNS name configured in the upstream must exactly match a SAN or CN in the server’s certificate, following RFC 6125 wildcard rules.
• TLS version is limited to what the Go TLS library supports (TLS 1.2 and TLS 1.3); older versions are rejected and cannot be downgraded via Consul configuration.
• There is no tls_skip_verify switch; disabling verification would require modifying the Consul binary or inserting a side‑car proxy.
• Certificate revocation (OCSP/CRL) is not checked; validation relies solely on the initial chain verification.

Steps to verify or work around the limit

1. Check Consul agent logs for TLS handshake entries when forwarding a DoT query; a successful handshake will show a line like TLS handshake completed.
2. Validate the upstream certificate manually with openssl s_client -connect :853 -servername to confirm it is trusted by the local system and matches the expected name.
3. If the upstream uses a private or self‑signed certificate, add that CA to the host’s trusted root store (e.g., update-ca-certificates on Linux) and restart the Consul agent.
4. After adding the CA, repeat the query and verify that the handshake succeeds without x509: certificate signed by unknown authority errors.
5. If modifying the host trust store is not feasible, deploy a local stub resolver or side‑car DoT proxy (such as stubby, cloudflared, or CoreDNS with the forward plugin) that performs its own TLS validation and forwards plain DNS to Consul’s DNS proxy.

Missing diagnostic detail

To decide whether host‑trust‑store modification is sufficient or a side‑car is required, please confirm whether you have the ability to add custom CA certificates to the system trust store on the node running Consul.