255オクテットのドメインはツラみがある! / endless-work

Presented on PHPerKaigi 2019 https://phperkaigi.jp/

longest domain here!
Shorten :
http://bit.ly/endless_work

original :
https://workworkworkworkworkwork.workworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkworkworkworkworkworkwork.work/

Transcript

1. 255จࣈͷ
   υϝΠϯ͸
   πϥΈ͕͋Δ!
   2019/03/31(Sun) PHPerKaigi 2019
   Jun Watanabe@rela1470
   

   View Slide

2. 15෼࿮ͳͷʹ
   εϥΠυ110ຕͳͷͰ
   ઌʹ·ͱΊ
   ɾ255จࣈ͡Όͳ͍(͝ΊΜ)
   ɾ64จࣈҎ্Ͱཁ஫ҙ!!!!
   

   View Slide

3. υϝΠϯͬͯ
   ͍ͭͷ·ʹ͔
   ૿͑ͯ·͢ΑͶ!
   

   View Slide

4. Θͨͳ΂͸
   13ݸ΋ͬͯ·ͨ͠
   

   View Slide

5. New gTLD
   ଓʑొ৔
   

   View Slide

6. View Slide

7. yasero.dev
   ࣗ෼ͷମॏΛࡽ͢αΠτ
   

   View Slide

8. ͱ͍͏͜ͱͰຊ୊…
   

   View Slide

9. υϝΠϯͬͯ
   Ͳ͜·Ͱ௕͘Ͱ͖Δ͔
   ஌ͬͯ·͔͢?
   

   View Slide

10. 255จࣈͷ
    υϝΠϯ͸
    πϥΈ͕͋Δ!
    2019/03/31(Sun) PHPerKaigi 2019
    Jun Watanabe@rela1470
    

    View Slide

11. workworkworkworkworkwork.
    workworkworkworkworkworkw
    orkworkworkwork.workworkwo
    rkworkworkworkworkworkwork
    workworkworkworkworkwork.
    workworkworkworkworkworkw
    orkworkworkworkworkworkwor
    kworkwork.workworkworkwork
    workworkworkworkworkworkw
    orkworkworkworkwork.work
    

    View Slide

12. workυϝΠϯ
    1ԁͰͨ͠
    

    View Slide

13. View Slide

14. ͋Γ͕ͱ͏
    ͍͟͝·͢!
    

    View Slide

15. (དྷ೥΋͓ئ͍͠·͢)
    

    View Slide

16. ͋Ε?
    

    View Slide

17. 255จࣈͷ
    υϝΠϯ͸
    πϥΈ͕͋Δ!
    2019/03/31(Sun) PHPerKaigi 2019
    Jun Watanabe@rela1470
    

    View Slide

18. workworkworkworkworkwork.
    workworkworkworkworkworkw
    orkworkworkwork.workworkwo
    rkworkworkworkworkworkwork
    workworkworkworkworkwork.
    workworkworkworkworkworkw
    orkworkworkworkworkworkwor
    kworkwork.workworkworkwork
    workworkworkworkworkworkw
    orkworkworkworkwork.work
    

    View Slide

19. ͦ͏ͳΜͰ͢
    

    View Slide

20. 253จࣈ
    ͔͠ͳ͍ͧ
    

    View Slide

21. ͓࿳ͼͱగਖ਼
    

    View Slide

22. 255จࣈͷ
    υϝΠϯ͸
    πϥΈ͕͋Δ!
    2019/03/31(Sun) PHPerKaigi 2019
    Jun Watanabe@rela1470
    

    View Slide

23. 255ΦΫςοτͷ
    υϝΠϯ͸
    πϥΈ͕͋Δ!
    2019/03/31(Sun) PHPerKaigi 2019
    Jun Watanabe@rela1470
    

    View Slide

24. View Slide

25. Ͳ͜Ͱఆٛ͞Ε͍ͯΔ͔
    

    View Slide

26. RFC1035
    2.3.4. Size limits
    255 Octet
    

    View Slide

27. 1 Octet
    8 bit
    1 Byte
    

    View Slide

28. ༨ஊ
    1Byte = 8 Bit
    ʹͳͬͨͷ͸
    2008೥
    IEC 80000-13

    https://www.iso.org/standard/31898.html
    JIS͸ະൃߦ
    IECΛӾཡ͢Δʹ͸158 CHF (17,450ԁ)…
    

    View Slide

29. ࠞཚ͠ͳ͍ͨΊʹ΋
    Octet
    Λ࢖͓͏!
    

    View Slide

30. ͞Βʹ༨ஊ
    URLશମͷ੍ݶ͸ͳ͍
    

    View Slide

31. 100ສจࣈ·Ͱಈ࡞֬ೝࡁΈ
    https://qiita.com/nwtgck/items/e83473dc63386d2da3e5
    

    View Slide

32. ؓ࿩ٳ୊
    

    View Slide

33. υϝΠϯͷσʔλ಺໿
    

    View Slide

34. work . work
    ↓ϥϕϧ
    ↑ ۠੾Γจࣈ
    ୈ2ϨϕϧυϝΠϯ ୈ1ϨϕϧυϝΠϯ
    

    View Slide

35. DNSϝοηʔδ
    ࠓճͷυϝΠϯͷྫ
    

    View Slide

36. ఆٛจࣈ௕
    ΦΫςοτ
    ϥϕϧจࣈྻ
    NBY
    ΦΫςοτ
    XPSLXPSLXPSLXPSLXPSLXPSL
    XPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSL
    XPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSL
    XPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSL
    XPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSLXPSL
    XPSL
    
    0DUFU 0DUFU
    
    workworkworkworkworkwork.workworkworkworkworkworkworkworkworkwork.workworkworkworkwor
    kworkworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkworkwor
    kworkworkworkwork.workworkworkworkworkworkworkworkworkworkworkworkworkworkwork.work
    ↓
    = 255 octet = 253จࣈ(υοτؚ)
    

    View Slide

37. ϝʔϧΞυϨε͸?
    

    View Slide

38. RFC5321
    4.5.3.1.3. Path
    256 Octet
    

    View Slide

39. શମͰ࠷େ 256 Octet ·Ͱ
    (υοτ΍ΞοτϚʔΫ΋ؚΉ)
    υϝΠϯͰ
    255 Octet ࢖͏ͷͰ…
    

    View Slide

40. υϝΠϯ͕࠷େ௕ͩͱ
    ࣮࣭ൃߦͰ͖ͳ͍
    @workworkworkworkworkwork.workworkworkworkwo
    rkworkworkworkworkwork.workworkworkworkworkw
    orkworkworkworkworkworkworkworkworkwork.work
    workworkworkworkworkworkworkworkworkworkwork
    workworkwork.workworkworkworkworkworkworkwor
    kworkworkworkworkworkworkwork.work
    ↑Ͱ256ΦΫςοτ(254จࣈ)
    

    View Slide

41. ࣮ࡍʹӡ༻͍͖ͯ͠
    

    View Slide

42. DNS
    

    View Slide

43. View Slide

44. ໊͓લυοτίϜ͞Μ
    ͦ΋ͦ΋ෳ਺ϥϕϧ͕
    ߟྀ͞Εͯͳ͍
    ϫΠϧυΧʔυͰͳΜͱ͔
    

    View Slide

45. SLAର৅ͷαʔϏεΛ
    ࢖͍·͠ΐ͏
    

    View Slide

46. Amazon
    Route 53
    
    

    View Slide

47. IDCF Cloud
    DNS
    
    

    View Slide

48. nginx
    

    View Slide

49. vi nginx.conf
    ———-
    server {
    listen 80;
    server_name
    workworkworkworkworkwork.workworkworkworkworkworkworkworkworkwork.workworkwor
    kworkworkworkworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkwor
    kworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkworkwor
    kworkworkworkwork.work;
    }
    ——————
    nginx -t
    nginx: [emerg] could not build server_names_hash, you should increase
    server_names_hash_bucket_size: 32
    nginx: configuration file /etc/nginx/nginx.conf test failed
    nginx.conf
    server_name͕௕͗͢Δ
    

    View Slide

50. vi nginx.conf
    ———-
    http {
    server_names_hash_bucket_size 512;
    }
    bucketSize֦ு
    

    View Slide

51. View Slide

52. HTTPSԽ
    

    View Slide

53. View Slide

54. DNS name too long
    # /usr/local/certbot/certbot-auto certonly --webroot -w /work.work -
    d
    workworkworkworkworkwork.workworkworkworkworkworkworkworkworkwork.wo
    rkworkworkworkworkworkworkworkworkworkworkworkworkworkwork.workworkw
    orkworkworkworkworkworkworkworkworkworkworkworkwork.workworkworkwork
    workworkworkworkworkworkworkworkworkworkwork.work
    Saving debug log to /var/log/letsencrypt/letsencrypt.log
    Plugins selected: Authenticator webroot, Installer None
    Obtaining a new certificate
    An unexpected error occurred:
    The request message was malformed :: Error creating new authz :: DNS
    name too long
    Please see the logfiles in /var/log/letsencrypt for more details.
    

    View Slide

55. certbot͕230จࣈҎ্Λ
    ड͚෇͚ͳ͍
    

    View Slide

56. ಺෦తʹJSONͷϝλ৘ใͰ
    25จࣈ࢖ͬͯ͠·͏ͨΊ
    letsencrypt/boulder.git/policy/pa.go@126
    // TODO(#3237): Right now our schema for the authz table only allows
    255 characters
    // for identifiers, including JSON wrapping, which takes up 25
    characters. For
    // now, we only allow identifiers up to 230 characters in length.
    When we are
    // able to do a migration to update this table, we can allow DNS
    names up to
    // 253 characters in length.
    maxLabelLength = 63
    maxDNSIdentifierLength = 230
    `identifier` varchar(255) NOT NULL,
    {"type":"dns","value":"example.com"}
    https://community.letsencrypt.org/t/i-want-use-max-255-octet-domain/51279
    

    View Slide

57. View Slide

58. View Slide

59. View Slide

60. Let’s Encrypt
    ͕ବ໨ͳΒ…
    

    View Slide

61. ී௨ͷ༗ྉSSLͳΒ
    ͍͚Μͷ͔
    

    View Slide

62. # openssl req -new -key key.pem -out key.csr
    Common Name (eg, fully qualified host name)
    []:workworkworkworkworkwork.workworkworkworkworkworkworkworkworkwork
    .workworkworkworkworkworkworkworkworkworkworkworkworkworkwork.workwo
    rkworkworkworkworkworkworkworkworkworkworkworkworkwork.workworkworkw
    orkworkworkworkworkworkworkworkworkworkworkwork.work
    OpenSSLͰCSRൃߦ΍!
    

    View Slide

63. string is too long,
    it needs to be less than
    64 bytes long
    

    View Slide

64. OpenSSL͕ବ໨ͳΒ…
    

    View Slide

65. Microsoft IIS
    

    View Slide

66. CSRൃߦͰ͖·ͨ͠
    

    View Slide

67. CoreSSL͞ΜͰਃ੥
    

    View Slide

68. View Slide

69. CSR͸ೝ͚ࣝͨ͠Ͳ
    αʔϏεଆͰ஄͔Εͨ
    

    View Slide

70. ্Ґূ໌ہ
    Symantec
    Comodo
    GeoTrust
    ͷ੍ݶ
    https://knowledge.symantec.com/jp/support/ssl-certificates-support/index?page=content&actp=CROSSLINK&id=SO24065
    

    View Slide

71. RFC 5280
    Appendix A.1
    ub-common-name-length
    INTEGER ::= 64
    ͪΐͬͱࣗ৴ͳ͍
    

    View Slide

72. ͝ฦۚ
    ରԠ௖͖
    ͋Γ͕ͱ͏
    ͍͟͝·ͨ͠
    
    

    View Slide

73. ແྉͰ230จࣈ·Ͱ͍͚Δ
    let's encrypt
    ٯʹ༏लઆ
    

    View Slide

74. View Slide

75. ࣗલ͕ବ໨ͳΒ...
    

    View Slide

76. αʔόʔϨε΍!
    

    View Slide

77. Firebase Hosting
    ແྉSSL+ແྉCDN(݄50GB·Ͱ)
    

    View Slide

78. Firebase Hosting
    ແྉSSL+ແྉCDN(݄50GB·Ͱ)
    

    View Slide

79. Firebase Hosting
    ແྉSSL+ແྉCDN(݄50GB·Ͱ)
    

    View Slide

80. SSL͕͍ͭ·Ͱܦͬͯ΋
    ൓ө͞Εͳ͍
    

    View Slide

81. UI΋յΕΔ
    

    View Slide

82. ͦͯ͠2019೥
    

    View Slide

83. υϝΠϯͷ௕͕͞
    ࠷େ64จࣈʹ੍ݶ͞ΕͯΔ…
    

    View Slide

84. Firebase͕
    ବ໨ͳΒ
    Netlify΍!
    

    View Slide

85. View Slide

86. View Slide

87. UI͸΋ͪΖΜյΕΔ
    

    View Slide

88. ͔͠͠
    255 octet ͷ
    υϝΠϯ͸ొ࿥Ͱ͖ͨ
    (ͼͬ͘Γ)
    

    View Slide

89. SSL͸…?
    

    View Slide

90. DNS name too long
    

    View Slide

91. Netlify
    ແྉSSL
    

    View Slide

92. 230จࣈʹ཈͑ͨΒ
    ͍͚Δ΍Ζ!
    

    View Slide

93. CN was longer than 64 bytes
    

    View Slide

94. View Slide

95. Firebase
    SSLରԠඞਢ
    64 octet ·Ͱ
    Netlify
    SSL͸ 64 octet ·Ͱ
    httpͰ΋Α͚Ε͹
    255 octet ·Ͱ
    

    View Slide

96. SSLରԠͷເ͸௵͑ͨ…
    

    View Slide

97. View Slide

98. ACME v2 API
    ϫΠϧυΧʔυূ໌ॻ
    

    View Slide

99. CN was longer than
    64 bytes
    ./certbot-auto certonly —manual -d
    *.workworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkw
    orkworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkwork
    workworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkwor
    kworkworkworkworkwork.work -m jun@harine.jp --agree-tos --manual-
    public-ip --preferred-challenges dns-01 --server https://acme-
    v02.api.letsencrypt.org/directory
    An unexpected error occurred:
    The request message was malformed :: Error finalizing order ::
    issuing precertificate: CN was longer than 64 bytes
    

    View Slide

100. cert-bot
     SAN ରԠ
     υϝΠϯෳ਺ࢦఆͰ͖Δ
     &
     ઌ಄ͷυϝΠϯ͕CNʹ
     

     View Slide

101. workworkworkworkworkw
     orkworkworkworkworkwor
     kworkworkworkwork.work
     65จࣈ
     

     View Slide

102. workworkworkworkwork.
     work
     25จࣈ
     

     View Slide

103. ./certbot-auto certonly --manual -d workworkworkworkwork.work -d
     *.workworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkw
     orkworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkwork
     workworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkwor
     kworkworkworkworkwork.work -m jun@harine.jp --agree-tos --manual-
     public-ip --preferred-challenges dns-01 --server https://acme-
     v02.api.letsencrypt.org/directory
     

     View Slide

104. Congratulations!
     ./certbot-auto certonly --manual -d workworkworkworkwork.work -d
     *.workworkworkworkworkworkworkworkworkwork.workworkworkworkworkworkw
     orkworkworkworkworkworkworkworkwork.workworkworkworkworkworkworkwork
     workworkworkworkworkworkwork.workworkworkworkworkworkworkworkworkwor
     kworkworkworkworkwork.work -m jun@harine.jp --agree-tos --manual-
     public-ip --preferred-challenges dns-01 --server https://acme-
     v02.api.letsencrypt.org/directory
     IMPORTANT NOTES:
     -
     Congratulations!
     Your certificate and chain have been saved at:
     /etc/letsencrypt/live/workworkworkworkwork.work/fullchain.pem
     

     View Slide

105. View Slide

106. View Slide

107. https://
     workworkworkworkworkwork.w
     orkworkworkworkworkworkwor
     kworkworkwork.workworkwork
     workworkworkworkworkworkw
     orkworkworkworkworkwork.wo
     rkworkworkworkworkworkwork
     workworkworkworkworkworkw
     orkwork.workworkworkworkwo
     rkworkworkworkworkworkwork
     workworkworkwork.work/
     

     View Slide

108. http://
     work.workworkworkworkworkw
     orkworkworkworkworkworkwor
     kworkworkwork.workworkwork
     workworkworkworkworkworkw
     orkworkworkworkworkwork.wo
     rkworkworkworkworkworkwork
     workworkworkworkworkworkw
     orkwork.workworkworkworkwo
     rkworkworkworkworkworkwork
     workworkworkwork.work/
     

     View Slide

109. http://
     workwork.workworkworkworkw
     orkworkworkworkworkworkwor
     kworkworkwork.workworkwork
     workworkworkworkworkworkw
     orkworkworkworkworkwork.wor
     kworkworkworkworkworkwork
     workworkworkworkworkworkw
     orkwork.workworkworkworkwor
     kworkworkworkworkworkwork
     workworkworkwork.work/public
     

     View Slide

110. http://bit.ly/endless_work
     http://bit.ly/work_netlify
     http://bit.ly/work_githubpages
     Jun Watanabe@rela1470
     https://rela.red/
     https://yasero.dev/
     Available for hire!
     

     View Slide