Questions tagged [dane]
The dane tag has no usage guidance.
13 questions
5
votes
2
answers
2k
views
What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?
What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)?
Secondly, how can I verify that DANE is ...
- 7,095
5
votes
2
answers
276
views
With DNSSEC, is there any benefit in DANE for a CA- issued Cert?
I just deployed DNSSEC at val-id.com and getvalid.com
Since DNSSEC is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by publishing my CA-...
- 51.1k
4
votes
1
answer
644
views
Is DANE-EE TLSA version 3 (Domain-issued certificate from rfc6698) still supported in 2023?
I would like to setup a webserver using TLS without relying on third party CA.
Is it still possible in 2023 ?
FreeBSD was using the feature and is now using Let's Encrypt (as well as a lot of privacy-...
- 589
4
votes
1
answer
837
views
Security of DNSSEC without NSEC
DNSSEC uses NSEC (or NSEC3) records to indicate that requested domain name does not exist. NSEC has been criticized because it allows zone enumeration.
What breaks, if dnssec is implemented without ...
- 159
3
votes
1
answer
983
views
Why is the DANE protocol depending on DNSSEC?
Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
- 7,095
3
votes
2
answers
2k
views
Is it okay to publish a TLSA records for non-DNSSEC CNAME'ed services?
In the scenario with two domain names
example.com secured with DNSSEC
example.org not secured with DNSSEC
and a mail service running at smtp.example.org:
I want to secure the mail service using TLSA/...
- 33
3
votes
1
answer
354
views
Email, Certificates and DANE [closed]
Does DANE offer the ability to provide certificates for services? Or is it just hosts?
How does one specify a mail server with DANE? If my email is [email protected] but mail.bar.com is the email server, ...
user29925
2
votes
2
answers
187
views
Use DANE to authentify mail sender
I have my own virtual DNS infrastructure, from the root to the mail server mail.example.com. Everything is signed using DNSSEC.
[email protected] can send email to [email protected], digitally ...
- 21
2
votes
1
answer
508
views
How does the DANE protocol make Certificate Authorities obsolete?
How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete?
In other words: How is it technically possible that DANE does not need Certificate ...
- 7,095
2
votes
1
answer
230
views
SSH like promiscuity for HTTPS
I want to build something, but I haven't seen it before. Maybe you have?
I'd like to build a HTML5 app, served to modern browsers and phones from a microcomputer (e.g. BBB). The microcomputer would ...
- 287
2
votes
2
answers
258
views
Non-TLS-authoritative ZSKs?
Under DANE, the digital chain of trust goes (roughly):
[Public visibility of the ceremony for the generation of the]
ICANN Root Zone Key, which
something something involving the TLD authorities and ...
1
vote
2
answers
1k
views
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?
Because with HPKP ...
- 7,095
0
votes
1
answer
139
views
Would DNSSec and DANE be more secure if the same key was published to different TLDs?
Assuming that it's tough to get many government owned TLDs to cooperate to spoof DANE or DNSSec, would it be wise to publish the same certificate (different SAN names) to various TLDs?
For example:
...
- 51.1k