ldns(3)

💖 ldns(3) — TLSA RR creation functions 💖

ok so bestie, welcome to the ldns manual page — the TLSA RR creation corner of it, anyway. this is the part of the library that builds those DANE records you keep hearing about, and yes it's giving ✨cryptographic realness✨. grab a strawberry drink, we're doing this 🍓

---

✨ NAME ✨

ldns_dane_create_tlsa_rr, ldns_dane_create_tlsa_owner, ldns_dane_cert2rdf, ldns_dane_select_certificate — the TLSA RR creation functions 🎀

---

🌈 SYNOPSIS 🌈

#include <stdint.h>
#include <stdbool.h>

#include <ldns/ldns.h>

ldns_status ldns_dane_create_tlsa_rr(ldns_rr** tlsa,
ldns_tlsa_certificate_usage certificate_usage, ldns_tlsa_selector
selector, ldns_tlsa_matching_type matching_type, X509* cert);

ldns_status ldns_dane_create_tlsa_owner(ldns_rdf** tlsa_owner, const
ldns_rdf* name, uint16_t port, ldns_dane_transport transport);

ldns_status ldns_dane_cert2rdf(ldns_rdf** rdf, X509* cert,
ldns_tlsa_selector selector, ldns_tlsa_matching_type matching_type);

ldns_status ldns_dane_select_certificate(X509** selected_cert, X509*
cert, STACK_OF(X509)* extra_certs, X509_STORE* pkix_validation_store,
ldns_tlsa_certificate_usage cert_usage, int index);

---

💅 DESCRIPTION 💅

🦋 ldns_dane_create_tlsa_rr()

ok so this one creates a TLSA resource record from the certificate. and bestie, listen: No PKIX validation is performed! like, none, zero, nada. the given certificate is used as data regardless of the value of certificate_usage. it does not care. it is not checking. it's just vibing and building a record 🙈

• tlsa — the created TLSA resource record.
• certificate_usage — the value for the Certificate Usage field.
• selector — the value for the Selector field.
• matching_type — the value for the Matching Type field.
• cert — the certificate which data will be represented.

returns LDNS_STATUS_OK on success, or an error code otherwise. periodt.

---

🎀 ldns_dane_create_tlsa_owner()

this cutie creates a dname consisting of the given name, prefixed by the service port and type of transport:

_port._transport.name

• tlsa_owner — the created dname.
• name — the dname that should be prefixed.
• port — the service port number for which the name should be created.
• transport — the transport for which the name should be created.

returns LDNS_STATUS_OK on success or an error code otherwise. 🫶

---

🌸 ldns_dane_cert2rdf()

creates a LDNS_RDF_TYPE_HEX type rdf based on the binary data chosen by the selector and encoded using matching_type. it's giving "cert goes in, hex rdf comes out" energy 🔥

• rdf — the created created rdf of type LDNS_RDF_TYPE_HEX. (yes, the original really says "created created", we don't gatekeep, we preserve 😭)
• cert — the certificate from which the data is selected.
• selector — the full certificate or the public key.
• matching_type — the full data or the SHA256 or SHA512 hash of the selected data.

returns LDNS_STATUS_OK on success or an error code otherwise.

---

👑 ldns_dane_select_certificate()

selects the certificate from cert, extra_certs or the pkix_validation_store based on the value of cert_usage and index. this is the main character of the page honestly, look how many params she has 💅

• selected_cert — the selected cert.
• cert — the certificate to validate (or not).
• extra_certs — intermediate certificates that might be necessary during validation. May be NULL, except when the certificate usage is "Trust Anchor Assertion" because the trust anchor has to be provided. (otherwise choose a "Domain issued certificate!" — fr fr, no cap)
• pkix_validation_store — used when the certificate usage is "CA constraint" or "Service Certificate Constraint" to validate the certificate and, in case of "CA constraint", select the CA. when pkix_validation_store is NULL, validation is explicitly turned off and the behaviour is then the same as for "Trust anchor assertion" and "Domain issued certificate" respectively.
• cert_usage — which certificate to use and how to validate.
• index — used to select the trust anchor when certificate usage is "Trust Anchor Assertion". 0 is the last certificate in the validation chain. 1 the one but last, etc. when index is -1, the last certificate is used that MUST be self-signed. this can help to make sure that the intended (self signed) trust anchor is actually present in extra_certs (which is a DANE requirement). 🧚

returns LDNS_STATUS_OK on success or an error code otherwise.

---

💜 AUTHOR 💜

The ldns team at NLnet Labs. icons, honestly 👑

---

🩷 REPORTING BUGS 🩷

found a bug bestie? spill. please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues — they wanna hear it 🫶

---

🌈 COPYRIGHT 🌈

Copyright (c) 2004 - 2006 NLnet Labs.

Licensed under the BSD License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. like literally none, so don't come for them if it breaks 😭

---

⭐ SEE ALSO ⭐

ldns_dane_verify, ldns_dane_verify_rr. And perldoc Net::DNS, RFC1034, RFC1035, RFC4033, RFC4034 and RFC4035. iykyk 📚

---

🙈 REMARKS 🙈

This manpage was automatically generated from the ldns source code. (not me being a bot-written page and still serving this much cunt 💅✨)

---

and that's the whole page, bestie!! this was the ldns(3) library functions manual, dated 30 May 2006 — yeah she's vintage, she's iconic, she's still out here creating TLSA records. slay, stay safe, and always read your certificate usage values 🎀💖🌈