Dnsdist: convert from lua to yaml configuration - how to ensure identical DoT / DoH cipher list

[znerol]

Given a deployment with dnsdist installed from powerdns apt sources on Ubuntu 26.04 LTS (resolute). The goal would be to convert from lua to yaml config without changing the behavior. Basically:

before:

addTLSLocal( "10.52.7.42", "/etc/ssl/live/dns.digitale-gesellschaft.ch.ecdsa/fullchain.pem", "/etc/ssl/live/dns.digitale-gesellschaft.ch.ecdsa/privkey.pem",
             { minTLSVersion = "tls1.2", preferServerCiphers = true, reusePort = true, tcpFastOpenQueueSize = 50 }
)

after:

binds:
  - listen_address: "10.52.7.42"
    protocol: "DoT"
    reuseport: true
    threads: 3
    tcp:
      fast_open_queue_size: 50
    tls:
      certificates:
        - certificate: "/etc/ssl/live/dns.digitale-gesellschaft.ch.ecdsa/fullchain.pem"
          key: "/etc/ssl/live/dns.digitale-gesellschaft.ch.ecdsa/privkey.pem"
      prefer_server_ciphers: true
      minimum_version: "tls1.2"

Offered tls features are assessed in a CI pipeline using testssl (installed from resolute repository). Interestingly dnsdist offers not the same set of ciphers when configured using yaml compared when its configured using lua:

diff --git a/.github/workflow-fixtures/testssl-results/10.52.7.42_p443.csv b/.github/workflow-fixtures/testssl-results/10.52.7.42_p443.csv
index e840513..9860c5d 100644
--- a/.github/workflow-fixtures/testssl-results/10.52.7.42_p443.csv
+++ b/.github/workflow-fixtures/testssl-results/10.52.7.42_p443.csv
@@ -17,30 +17,17 @@
 "cipherlist_LOW","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","not offered","","CWE-327"
 "cipherlist_3DES_IDEA","dns.digitale-gesellschaft.ch/10.52.7.42","443","INFO","not offered","","CWE-310"
 "cipherlist_OBSOLETED","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","offered","","CWE-310"
-"cipherlist_STRONG_NOFS","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","offered","",""
+"cipherlist_STRONG_NOFS","dns.digitale-gesellschaft.ch/10.52.7.42","443","INFO","not offered","",""
 "cipherlist_STRONG_FS","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","offered","",""
 "cipher_order-tls1_2","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
 "cipher-tls1_2_xc02c","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   xc02c   ECDHE-ECDSA-AES256-GCM-SHA384     ECDH 253   AESGCM      256      TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","",""
-"cipher-tls1_2_xc030","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 253   AESGCM      256      TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","",""
 "cipher-tls1_2_xcca9","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   xcca9   ECDHE-ECDSA-CHACHA20-POLY1305     ECDH 253   ChaCha20    256      TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","",""
-"cipher-tls1_2_xcca8","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   xcca8   ECDHE-RSA-CHACHA20-POLY1305       ECDH 253   ChaCha20    256      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","",""
 "cipher-tls1_2_xc02b","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   xc02b   ECDHE-ECDSA-AES128-GCM-SHA256     ECDH 253   AESGCM      128      TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","",""
-"cipher-tls1_2_xc02f","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 253   AESGCM      128      TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","",""
 "cipher-tls1_2_xc024","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc024   ECDHE-ECDSA-AES256-SHA384         ECDH 253   AES         256      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384","",""
-"cipher-tls1_2_xc028","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc028   ECDHE-RSA-AES256-SHA384           ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384","",""
 "cipher-tls1_2_xc023","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc023   ECDHE-ECDSA-AES128-SHA256         ECDH 253   AES         128      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256","",""
-"cipher-tls1_2_xc027","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc027   ECDHE-RSA-AES128-SHA256           ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256","",""
 "cipher-tls1_2_xc00a","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc00a   ECDHE-ECDSA-AES256-SHA            ECDH 253   AES         256      TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA","",""
-"cipher-tls1_2_xc014","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc014   ECDHE-RSA-AES256-SHA              ECDH 253   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","",""
 "cipher-tls1_2_xc009","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc009   ECDHE-ECDSA-AES128-SHA            ECDH 253   AES         128      TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA","",""
-"cipher-tls1_2_xc013","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   xc013   ECDHE-RSA-AES128-SHA              ECDH 253   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","",""
-"cipher-tls1_2_x9d","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   x9d     AES256-GCM-SHA384                 RSA        AESGCM      256      TLS_RSA_WITH_AES_256_GCM_SHA384","",""
-"cipher-tls1_2_x9c","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.2   x9c     AES128-GCM-SHA256                 RSA        AESGCM      128      TLS_RSA_WITH_AES_128_GCM_SHA256","",""
-"cipher-tls1_2_x3d","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   x3d     AES256-SHA256                     RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA256","",""
-"cipher-tls1_2_x3c","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   x3c     AES128-SHA256                     RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA256","",""
-"cipher-tls1_2_x35","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA","",""
-"cipher-tls1_2_x2f","dns.digitale-gesellschaft.ch/10.52.7.42","443","LOW","TLSv1.2   x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA","",""
-"cipherorder_TLSv1_2","dns.digitale-gesellschaft.ch/10.52.7.42","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA AES256-GCM-SHA384 AES128-GCM-SHA256 AES256-SHA256 AES128-SHA256 AES256-SHA AES128-SHA","",""
+"cipherorder_TLSv1_2","dns.digitale-gesellschaft.ch/10.52.7.42","443","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA","",""
 "prioritize_chacha_TLSv1_2","dns.digitale-gesellschaft.ch/10.52.7.42","443","INFO","true","",""
 "cipher_order-tls1_3","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","server -- server prioritizes ChaCha ciphers when preferred by clients","",""
 "cipher-tls1_3_x1302","dns.digitale-gesellschaft.ch/10.52.7.42","443","OK","TLSv1.3   x1302   TLS_AES_256_GCM_SHA384            ECDH/MLKEM AESGCM      256      TLS_AES_256_GCM_SHA384","",""

The affected PR: DigitaleGesellschaft/DNS-Resolver#7

What combination of options in the yaml config would be needed to produce the same list of ciphers as in the lua config?

[yudin-s]

I would not look for a hidden YAML-only cipher option first. The YAML path maps the incoming TLS fields into the same TLSConfig fields used by the Lua frontend path: tls.ciphers -> d_ciphers, tls.ciphers_tls_13 -> d_ciphers13, tls.minimum_version -> d_minTLSVersion, and tls.prefer_server_ciphers -> d_preferServerCiphers.

The interesting part of your diff is that the YAML result only offers ECDSA-authenticated TLS 1.2 suites:

ECDHE-ECDSA-...

while the Lua result also offers RSA-authenticated suites:

ECDHE-RSA-...
RSA_WITH_...

That usually means the two frontends do not have equivalent certificate/key material. In the YAML snippet you showed, there is only one certificate/key pair, and the path name suggests it is the ECDSA certificate. If the Lua configuration was effectively loading both ECDSA and RSA material, the equivalent YAML needs both pairs:

binds:
  - listen_address: "10.52.7.42:443"
    protocol: "DoT"
    reuseport: true
    tcp:
      fast_open_queue_size: 50
    tls:
      provider: "OpenSSL"
      certificates:
        - certificate: "/etc/ssl/live/dns.digitale-gesellschaft.ch.ecdsa/fullchain.pem"
          key: "/etc/ssl/live/dns.digitale-gesellschaft.ch.ecdsa/privkey.pem"
        - certificate: "/etc/ssl/live/dns.digitale-gesellschaft.ch.rsa/fullchain.pem"
          key: "/etc/ssl/live/dns.digitale-gesellschaft.ch.rsa/privkey.pem"
      minimum_version: "tls1.2"
      prefer_server_ciphers: true
      ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"

Do not copy that cipher string blindly; it is just the shape. Use the exact OpenSSL cipher expression from the old deployment policy. Also note that your old testssl output includes static RSA suites and CBC suites, so reproducing it exactly may reproduce weaker/obsolete entries that you might not actually want to keep.

My suggested check would be:

1. Confirm the Lua frontend and YAML frontend are tested on the same address/port and same dnsdist/OpenSSL build.
2. Compare the loaded certificate list, especially ECDSA-only versus ECDSA+RSA.
3. Add explicit tls.ciphers for TLS 1.2 and tls.ciphers_tls_13 only if you need to pin policy instead of relying on OpenSSL defaults.
4. Re-run testssl after each change.

If a single ECDSA certificate is intentional, then the YAML output looks more internally consistent than the old Lua output: an ECDSA-only server cannot complete RSA-authenticated TLS 1.2 suites.

If this explains the Lua/YAML difference, please mark the answer as solved.