DNS over TLS issues

[doineedto]

Has anyone using DNS over TLS started facing connectivity issues recently?
I am unable to use Private DNS on Android devices since the past week. This is observed even on the LTE network.

 

[Sushubh]

Have you tried using a different server?

 

[doineedto]

Yeah. I have a private server which has stopped working. Tried adguard public server. It works intermittently throughout the day

 

[shantam2005]

Same with me. Facing this since sometime in September. I also switched my phone around the same time so thought this was a phone issue.

 

[JB701]

that is interesting. you could try using wireshark on pc with "tcp.port==853" filter to see whats causing the issue.

you can use yogadns client

 

[royalroy]

Let's encrypt root certificate has expired and Android system has not updated it. Use a TLS certificate from some other authority.

 

[JB701]

Let's encrypt root certificate has expired and Android system has not updated it. Use a TLS certificate from some other authority.

AdGuard DNS ( dns.adguard.com) uses their own cert though (not Letsencrypt) . Unless, OP meant AdGuard Home.

I tried dns.google one.one.one.one and dns.adguard.com on Airtel LTE and its all working fine.

 

[doineedto]

Let's encrypt root certificate has expired and Android system has not updated it. Use a TLS certificate from some other authority.

Interesting. Did not know that. Let me try this.

But I also tried 'dns.adguard.com' and even this intermittently gives me a 'Private DNS cannot be accessed message'

 

[doineedto]

Let's encrypt root certificate has expired and Android system has not updated it. Use a TLS certificate from some other authority.

According to Let's Encrypt documentation, only Android devices prior to version 7.1.1 will have any issues whatsoever. I am on Android 11. So this seems less likely to happen.

Certificate Compatibility

The determining factor for whether a platform can validate Let’s Encrypt certificates is whether that platform trusts ISRG’s “ISRG Root X1” or “ISRG Root X2” certificates. Both of these roots have been included in platform trust stores for several years now (ISRG Root X1 since late 2016, ISRG...

letsencrypt.org

 

[royalroy]

I was facing the same issues with Adguard Home. Eventually, I changed the certificate and the issue was gone.