TLSA(1)

🦋 TLSA(1) — Internet / DNS 🦋

hiii bestie 💖 welcome to the manual page for tlsa, straight out of the Internet / DNS section (section 1, so it's a real user command you just run, not some config file you have to whisper to). grab a boba, we're doing DNS records today ✨

---

💖 NAME 💖

tlsa — create and verify RFC-6698 TLSA DNS records. that's it. that's the whole job. she does one thing and she slays it 💅

---

🌸 SYNTAX 🌸

okay so here's literally how you call her, no cap, copy-paste as-is:

tlsa [-h] [--verify] [-create] [--version] [-4] [-6] [--insecure]
[--resolvconf /PATH/TO/RESOLV.CONF] [--port PORT] [--starttls
{auto,smtp,imap,pop3,ftp}] [--protocol {tcp,udp,sctp}] [--only-rr]
[--rootkey /PATH/TO/ROOT.KEY] [--ca-cert /PATH/TO/CERTSTORE] [--debug]
[--quiet] [--certificate CERTIFICATE] [--output {rfc,generic,both}]
[--usage {0,1,2,3}] [--selector {0,1}] [-mtype {0,1,2}] hostname

and the last thing on the line, hostname, is the name you're pointing her at. she needs it. she's not psychic 🫶

little heads up, bestie: a few of the flags up there (-h, --version, -4, -6, --insecure, --debug, --quiet) show up in the syntax line but don't get their own blurb down in OPTIONS. and yeah, -create and -mtype are spelled with one dash up here while OPTIONS spells them --create and --mtype — that's literally what the page says, i'm not editing it, iykyk 💀

---

✨ DESCRIPTION ✨

so tlsa generates RFC-6698 TLSA DNS records. iconic. 🎀

here's the tea: some older nameserver implementations don't support the TLSA record yet (tragic, i know 😭). for those, you pass --output generic and she'll hand you the tlsa data in Generic Record (RFC-3597) format instead. problem solved, we move 💅

how does she get the goods? she connects to the website using SSL and grabs the (EE) certificate and the CA chain. then, depending on the type and selector you picked, that info gets turned into TLSA records. so smart. so efficient. main character energy fr fr ✨

Currently. tlsa has no AXFR support for en-mass TLSA record generation. so like, one hostname at a time, bestie. no bulk mode yet 🙈

---

💅 OPTIONS 💅

• --create — create a TLSA record. yes, she's making you a record. periodt ✨
• --verify — verify a TLSA record. the vibe check, if you will 👑
• --protocol tcp | udp | sctp — pick your transport protocol (default: tcp)
• --resolvconf FILE — point her at a custom resolv.conf file (default: /etc/resolv.conf). you can also pass an empty value (--resolvconf="") to disable the default entirely 🚫
• --port PORT — use the port you say (default: 443)
• --starttls no | smtp | imap | pop3 | ftp — the start script type, for protocols that need special commands before the TLS connection can even start. supported: 'ftp' (port 21), 'smtp' (port 25), 'pop3' (port 110) and 'imap' (port 143). by default she picks the type based on the port number, and the value 'no' overrides that auto detection. (and yes, the syntax line up top writes this one as {auto,smtp,imap,pop3,ftp} — both spellings are literally on this page, don't come for me 😭)
• --only-rr — only print the DNS TLSA record. nothing else. minimalism 💖
• --certificate file.crt — use this certificate file instead of fetching one off the server. can be a single cert or a complete chain 🧚
• --ca-cert directory — use this directory full of CA bundles for CA validation (default: /etc/pki/tls/certs)
• --rootkey filename — use this file to read the DNSSEC root key (in anchor or bind format) 🔑
• --output rfc | generic | both — output format of the TLSA record. "TLSA" for rfc, "TYPE52" for generic (default: rfc)
• --usage 0 | 1 | 2 | 3 — usage type: public CA (0), EE match validated by public CA (1), private CA (2), private EE (3) (default: 3)
• --selector 0 | 1 — the selector type describes what the type covers — full certificate (0) or public key (1) (default: 0)
• --mtype 0 | 1 | 2 — type of the TLSA data. exact match on content (0), SHA256 (1) or SHA512 (2) (default: 0)

and if you specify neither create or verify? she just does create. default behaviour, she's decisive like that 🫶

---

🎀 REQUIREMENTS 🎀

tlsa requires the following python libraries: unbound, cryptography, argparse and ipaddr. that's the whole shopping list 🛒✨

---

💀 BUGS 💀

ipv4/ipv6 handling. that's it. that's the bug note. she said what she said 🙈

---

🌈 EXAMPLES 🌈

typical usage:

tlsa www.fedoraproject.org

tlsa --verify -4 nohats.ca

tlsa --create --insecure fedoraproject.org

go off bestie, look at you using flags and everything 🔥

---

⭐ SEE ALSO ⭐

sshfp(1), ssh-keygen(1) and RFC-6698 — the little family of related reading 🫶

https://github.com/letoams/hash-slinger

http://os3sec.org/

---

👑 AUTHORS 👑

Pieter Lexis <pieter.lexis@os3.nl> — we love her, we thank her 💜

---

🧚 COPYRIGHT 🧚

Copyright 2012

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License (file COPYING in the distribution) for more details.

ok bestie, real talk for a sec — that ALL CAPS bit is not a vibe, it's the actual legal text, so don't skip it 💖

---

and that's the whole page, you ate it up 🌸 this lil manual was written by Paul Wouters and dated December 7, 2015, and it lives in the TLSA(1) section of the manual — so if you ever forget, just yell man tlsa and she'll come running. bye bestie, go make some records 💅✨🦋