I need to setup TLSA records in the DNS for my host. I want to use it for HTTPS, e-mail and SSH.
- What are TLSA records?
- What does TLSA records look like?
- How do I create TLSA records?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
TLSA Resource Records is a type of DNS Records. Assuming they're used with a DNSSEC-enabled domain they provide a way to ensure the authenticity of the X.509 certificate (normal certificate) provided by server the domain points to, without the need for a classic Certificate Authority. This is called DANE which stands for DNS-based Authentication of Named Entities.
There ore multiple "usages" defined which allows you to tell the user agent (e.g. a web browser) to trust your very own CA (cool huh?). They can be seen as a mix of SRV records and broader SSHFP records.
TLSA Resource Records have a very simple structure, they specify which service (domain, IP protocol, port), a type of X.509 certificate and the corresponding Base64 encoded hash. Everything except for the Service Locator is bound the the certificate only and can be used together with many locators without any changes.
The service locator in typical DNS fashion, like the SRV record but instead of service name you specify the port (in this example TCP port 25).
Currently specified values are:
There are currently two different Selector Types for TLSA records and these are:
These are NOT related to the selectors for DKIM.
Allowed values are dofined in the IANA registry.
The hash of the certificate. If matching type is 0 the entire certificate is used instead.
$ tlsa --usage 1 --selector 1 --mtype 1 --certificate /path/to/certificate.pem example.com _443._tcp.example.com. IN TLSA 1 1 1 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef012345