SQ(1)

💅 SQ(1) — the sq network dane girlies' guide

okay so bestie, welcome to sq-network-dane — that's the part of sq that Retrieve and publishes certificates via DANE. yes, both. it does both. multitasking queen behavior. 👑

So what even is DANE? DNS-Based Authentication of Named Entities — it's a method for publishing and retrieving certificates in DNS as specified in RFC 7929. that's it, that's the whole vibe. certs living in DNS. iconic fr fr. ✨

---

🌸 SYNOPSIS 🌸

sq network dane search [OPTIONS] ADDRESS
sq network dane generate [OPTIONS]

two subcommands, one dream. search and generate. pick your fighter. 🎀

---

✨ DESCRIPTION ✨

Retrieve and publishes certificates via DANE.

DNS-Based Authentication of Named Entities (DANE) is a method for publishing and retrieving certificates in DNS as specified in RFC 7929. no cap, that's literally what it says and it's literally what it does. 🦋

---

👑 SUBCOMMANDS 👑

sq network dane search 🔍

Retrieve certificates using DANE. it's giving "go get me that cert, bestie."

By default, any returned certificates are stored in the local certificate store. but you can override that by using the --output option. your choice, your rules. 💅

Now this next part is lowkey important so listen up. When a certificate is retrieved using DANE, and imported into the local certificate store, any User IDs with the email address that was looked up are certificated with a local DANE-specific key. that proxy certificate is in turn certified as a minimally trusted CA — trust amount: 1 of 120 — by the local trust root. (one out of a hundred and twenty. crumbs. but crumbs that count. 😭)

How much the DANE proxy CA is trusted can be tuned using sq pki link add or sq pki link retract in the usual way. so if you want more trust, you know where to go.

---

sq network dane generate 🏭

Generate DANE records for the given domain and certs. factory setting: on. 🔥

The certificates are minimized, and one record per email address is emitted. If multiple user IDs map to one email address, then all matching user IDs are included in the emitted certificates. all of them. no girl left behind. 🫶

By default, OPENPGPKEY resource records are emitted. If your DNS server doesn't understand those, use --type generic to emit generic records instead. it's giving "your server, your rules." 🌈

---

💖 EXAMPLES 💖

sq network dane search

Retrieve Alice's certificate over DANE. go alice go. 🌸

sq network dane search alice@example.org

Retrieve updates for all known certificates over DANE. --all girlies rise. ⭐

sq network dane search --all

sq network dane generate

Generate DANE records from juliet.pgp for example.org.

sq network dane generate --domain=example.org \
       --cert-file=juliet.pgp

Generate DANE records for all certs with an authenticated user ID in example.org.

sq network dane generate --domain=example.org --all

---

🦋 SEE ALSO 🦋

• sq(1)
• sq-network(1)
• sq-network-dane-search(1)
• sq-network-dane-generate(1)

For the full documentation see <https://book.sequoia-pgp.org/>. it's the mothership, go read it. 📚

---

🎀 VERSION 🎀

1.5.0

---

quick reminder bestie: this page is sq-network-dane, living in the SQ(1) manual, shipped by Sequoia PGP at version 1.5.0. mwah, take care of her 💜✨