Skip to content

Instantly share code, notes, and snippets.

@vg

vg/x509-dane.md

Forked from buffrr/x509-dane.md
Created May 11, 2023 13:27
Show Gist options
  • Save vg/c67345a33a59ea7c8bcf73c7efad2925 to your computer and use it in GitHub Desktop.
Save vg/c67345a33a59ea7c8bcf73c7efad2925 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @buffrr buffrr revised this gist Jul 28, 2021. 1 changed file with 5 additions and 6 deletions.
    11 changes: 5 additions & 6 deletions x509-dane.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,12 +7,11 @@ openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
    <(echo "[req]";
    echo distinguished_name=req;
    echo "[ext]";
    echo keyUsage=critical,digitalSignature,keyEncipherment
    echo extendedKeyUsage=serverAuth
    echo basicConstraints=critical,CA:FALSE
    echo subjectAltName=DNS:example.com,DNS:*.example.com
    ) \
    -subj "/CN=*.example.com"
    echo "keyUsage=critical,digitalSignature,keyEncipherment";
    echo "extendedKeyUsage=serverAuth";
    echo "basicConstraints=critical,CA:FALSE";
    echo "subjectAltName=DNS:example.com,DNS:*.example.com";
    ) -subj "/CN=*.example.com"
    ```

    Generate the TLSA record rdata (you can also use [this tool](https://www.huque.com/bin/gen_tlsa)):
  2. @buffrr buffrr revised this gist Jul 7, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion x509-dane.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@ openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
    <(echo "[req]";
    echo distinguished_name=req;
    echo "[ext]";
    echo keyUsage=critical,digitalSignature
    echo keyUsage=critical,digitalSignature,keyEncipherment
    echo extendedKeyUsage=serverAuth
    echo basicConstraints=critical,CA:FALSE
    echo subjectAltName=DNS:example.com,DNS:*.example.com
  3. @buffrr buffrr renamed this gist Jul 7, 2021. 1 changed file with 0 additions and 0 deletions.
    0 x509-dane → x509-dane.md
    View file
    File renamed without changes.
  4. @buffrr buffrr created this gist Jul 7, 2021.
    23 changes: 23 additions & 0 deletions x509-dane
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,23 @@

    Creating a self-signed certificate for `example.com` (if you already have a certificate you can skip this step):

    ```
    openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
    -keyout cert.key -out cert.crt -extensions ext -config \
    <(echo "[req]";
    echo distinguished_name=req;
    echo "[ext]";
    echo keyUsage=critical,digitalSignature
    echo extendedKeyUsage=serverAuth
    echo basicConstraints=critical,CA:FALSE
    echo subjectAltName=DNS:example.com,DNS:*.example.com
    ) \
    -subj "/CN=*.example.com"
    ```

    Generate the TLSA record rdata (you can also use [this tool](https://www.huque.com/bin/gen_tlsa)):
    ```
    echo -n "3 1 1 " && openssl x509 -in cert.crt -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | xxd -p -u -c 32
    ```

    Add the TLSA record to your zone file