ldns-dane(1)

📦
version 1.9.2 · 10 versions
, in arch rolling

💅 NAME 💅

ok so ldns-dane — it verifies or creates TLS authentication with DANE (RFC6698). that's the whole vibe. it's giving "trust, but cryptographically" ✨

🎀 SYNOPSIS 🎀

ldns-dane [OPTIONS] verify name port
ldns-dane [OPTIONS] -t tlsafile verify

ldns-dane [OPTIONS] create name port
          [ Certificate-usage [ Selector [ Matching-type ] ] ]

ldns-dane -h
ldns-dane -v

🌸 DESCRIPTION 🌸

bestie there are three whole modes and they're all iconic in different ways:

Form one, the classic: a TLS connection to name:port gets established, and the TLSA resource record(s) for name are used to authenticate that connection. slay.

Form two, the file-kid: the TLSA record(s) get read from tlsafile instead, and those are what authenticate the TLS service they reference. no network lookup for the records themselves 🦋

Form three, the creator: a TLS connection to name:port is established and then used to create the TLSA resource record(s) that would authenticate the connection. main character energy — it's making the receipts, not checking them 🔥

the parameters for TLSA rr creation are, in order:

Certificate-usage:

  • 0 | PKIX-TA — CA constraint
  • 1 | PKIX-EE — Service certificate constraint
  • 2 | DANE-TA — Trust anchor assertion
  • 3 | DANE-EE — Domain-issued certificate (this is the default, no cap)

Selector:

  • 0 | Cert — Full certificate
  • 1 | SPKI — SubjectPublicKeyInfo (default, periodt)

Matching-type:

  • 0 | Full — No hash used
  • 1 | SHA2-256 — SHA-256 (default)
  • 2 | SHA2-512 — SHA-512

✨ OPTIONS ✨

  • -4 — TLS connect IPv4 only. v4 girlies only 💜
  • -6 — TLS connect IPv6 only. v6 girlies only 💜
  • -a address — don't even try to resolve name, just connect to address instead. lowkey a shortcut and we love her. this option may be given more than once 🫶
  • -b — print the "name. TYPE52 \# size hexdata" form instead of the TLSA presentation format. different font, same energy 💅
  • -c certfile — do NOT TLS connect to name:port; instead authenticate (or make TLSA records) for the certificate (chain) in certfile. offline mode era 🌈
  • -d — assume DNSSEC validity even when the TLSA records were acquired insecure or were bogus. yeah she's trusting like that 🙈
  • -f CAfile — use CAfile to validate.
  • -h — print short usage help.
  • -i — interact after connecting. it's a conversation now 💬
  • -k keyfile — specify a file that contains a trusted DNSKEY or DS rr. key(s) are used when chasing signatures (i.e. when -S is given). this option may be given more than once. alternatively, if -k is not specified, and a default trust anchor (/etc/trusted-key.key) exists and contains a valid DNSKEY or DS record, it will be used as the trust anchor. built-in bestie 🔑
  • -n — do not verify server name in certificate. chaotic but ok 🫣
  • -o offset — when creating a "Trust anchor assertion" TLSA resource record, select the offsetth certificate offset from the end of the validation chain. 0 means the last certificate, 1 the one but last, 2 the second but last, etc. when offset is -1 (the default), the last certificate is used (like with 0) that MUST be self-signed — and ooh this one actually matters: it can help to make sure that the intended (self signed) trust anchor is actually present in the server certificate chain (which is a DANE requirement). so like, it's a vibe check on your own chain 👑
  • -p CApath — use certificates in the CApath directory to validate.
  • -s — when creating TLSA resource records with the "CA Constraint" and the "Service Certificate Constraint" certificate usage, do not validate and assume PKIX is valid. for "CA Constraint" this means that verification should end with a self-signed certificate. no thoughts, assume valid 🧚
  • -S — chase signature(s) to a known key. without this option, the local network is trusted to provide a DNSSEC resolver (i.e. AD bit is checked). literally the difference between "trust the room" and "trust the key" 💀
  • -t tlsafile — read TLSA record(s) from tlsafile. when name and port are also given, only TLSA records that match the name, port and transport are used. otherwise the owner name of the TLSA record(s) will be used to determine name, port and transport. it figures it out itself, queen behavior ⭐
  • -T — return exit status 2 for PKIX validated connections without (secure) TLSA records(s). a very specific little flag and we stan a specific little flag 🍓
  • -u — use UDP transport instead of TCP. speedrun 🌬️
  • -v — show version and exit.

🦋 FILES 🦋

  • /etc/trusted-key.key — the file from which trusted keys are loaded for signature chasing, when no -k option is given. the default boo 💖

🔥 SEE ALSO 🔥

unbound-anchor(8)

👑 AUTHOR 👑

written by the ldns team as an example for ldns usage. (yes they made a whole DANE tool as a "for instance". flex.)

😭 REPORTING BUGS 😭

report bugs to <dns-team@nlnetlabs.nl>. be nice about it, they're doing their best 🫶

Copyright (C) 2012 NLnet Labs. This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

ngl the "no warranty" part is real — not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. take it seriously, bestie 🙈

ok that's the whole page!! this one's from the ldns-dane(1) manual in the General Commands Manual section, and the version date on it is 17 September 2012 — yeah she's an elder but she still ate 💅✨🎀

📦 where this page comes from