Quad9 Certificate Hash not found

[exaCORE42]

Trying to connect to quad9-doh-ip4-port443 results in a Certificate Hash not found error. Is there something that can be done to fix this?

[CrustyB]

I tried to update the sig in the config file... the commented out config already in the config toml file and the sig instructions on quad9's website are the same. This tells me that quad9 updated the cert, but hasn't updated the instructions yet.
https://www.quad9.net/quad9-resolvers.toml

Search "sources.quad9-resolvers" in the main config file to see the same config as above

[CrustyB]

jedisct1 is aware of the issue and will fix soon.
In the meantime, I have switched my Quad9 resolvers to DNSCrypt permanently.
I have 4 DNS providers configured, and two of them are DOH, and two of them (one is Quad9) are dnscrypt.

Seems more resilient that way.

Discussions about this:
#2665
DNSCrypt/dnscrypt-resolvers#941

[exaCORE42]

Does using the DnsCrypt option prevent this kind of thing from happening?

[jedisct1]

Does using the DnsCrypt option prevent this kind of thing from happening?

Yes.

[exaCORE42]

How does it do that?

[wwwrando]

I wrote a short go program to obtain an updated sdns stamp given an old sdns stamp:
https://github.com/wwwrando/dohstamp

This is based on a suggestion from:
DNSCrypt/dnscrypt-resolvers#941

[lifenjoiner]

No big deal, guys~
dnscrypt-proxy's advantage is you can preset several to many upstream servers, and it will choose from them.
You have figured out "quad9 updated the cert, but hasn't updated the instructions yet". We appreciate your notification, and try to keep the page with the upstream ASAP. That's it.

[AndLLA]

Hello,
The current configuration file
seems to be still outdated for some Quad9 Servers ( quad9-doh-ip4-port5053-filter-*) :

[2024-08-07 11:35:39] [NOTICE] dnscrypt-proxy 2.1.5
...
[2024-08-07 11:35:40] [NOTICE] Advertised cert: [CN=dns.quad9.net,O=Quad9,L=Zurich,ST=Zurich,C=CH] [e3e13daef1fd3012db80b3b002b5d2a7f24a7c8bb82b318694bdcaf061d1ba02]
[2024-08-07 11:35:40] [NOTICE] Advertised cert: [CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1,O=DigiCert Inc,C=US] [b01920744bbb76c9ab053e01e07b7e050e473d20f79f7bea435fafe43c9d242f]
[2024-08-07 11:35:40] [CRITICAL] [quad9-doh-ip4-port5053-filter-pri] Certificate hash [2a15f5d6acb6e7c0901ade4ebbc743b2ccd489032b46e1642f0693683001258a] not found
[2024-08-07 11:35:40] [NOTICE] Advertised cert: [CN=dns.quad9.net,O=Quad9,L=Zurich,ST=Zurich,C=CH] [e3e13daef1fd3012db80b3b002b5d2a7f24a7c8bb82b318694bdcaf061d1ba02]
[2024-08-07 11:35:40] [NOTICE] Advertised cert: [CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1,O=DigiCert Inc,C=US] [b01920744bbb76c9ab053e01e07b7e050e473d20f79f7bea435fafe43c9d242f]
[2024-08-07 11:35:40] [NOTICE] [quad9-doh-ip4-port443-filter-pri] OK (DoH) - rtt: 23ms
[2024-08-07 11:35:40] [NOTICE] Server with the lowest initial latency: quad9-doh-ip4-port443-filter-pri (rtt: 23ms)

[sources.public-resolvers]
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md']
cache_file = '/var/cache/dnscrypt-proxy/public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''