Questions tagged [dane]
The dane tag has no usage guidance.
Is DANE-EE TLSA version 3 (Domain-issued certificate from rfc6698) still supported in 2023?
I would like to setup a webserver using TLS without relying on third party CA. Is it still possible in 2023 ? FreeBSD was using the feature and is now using Let's Encrypt (as well as a lot of privacy-...
Under DANE, the digital chain of trust goes (roughly): [Public visibility of the ceremony for the generation of the] ICANN Root Zone Key, which something something involving the TLD authorities and ...
Is it okay to publish a TLSA records for non-DNSSEC CNAME'ed services?
In the scenario with two domain names example.com secured with DNSSEC example.org not secured with DNSSEC and a mail service running at smtp.example.org: I want to secure the mail service using TLSA/...
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)? Because with HPKP ...
Why is the DANE protocol depending on DNSSEC?
Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
How does the DANE protocol make Certificate Authorities obsolete?
How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
Would DNSSec and DANE be more secure if the same key was published to different TLDs?
Assuming that it's tough to get many government owned TLDs to cooperate to spoof DANE or DNSSec, would it be wise to publish the same certificate (different SAN names) to various TLDs? For example: ...
Security of DNSSEC without NSEC
DNSSEC uses NSEC (or NSEC3) records to indicate that requested domain name does not exist. NSEC has been criticized because it allows zone enumeration. What breaks, if dnssec is implemented without ...
What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?
What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)? Secondly, how can I verify that DANE is ...
SSH like promiscuity for HTTPS
I want to build something, but I haven't seen it before. Maybe you have? I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
Use DANE to authentify mail sender
I have my own virtual DNS infrastructure, from the root to the mail server mail.example.com. Everything is signed using DNSSEC. firstname.lastname@example.org can send email to email@example.com, digitally ...
With DNSSEC, is there any benefit in DANE for a CA- issued Cert?
I just deployed DNSSEC at val-id.com and getvalid.com Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
Email, Certificates and DANE [closed]
Does DANE offer the ability to provide certificates for services? Or is it just hosts? How does one specify a mail server with DANE? If my email is firstname.lastname@example.org but mail.bar.com is the email server, ...