Easily compute DANE TLSA records

I’m not going to rant about CAs vs. DANE here, there’s tons of reading on that on the web already, but for a primer the DANE RFC is quite good. I’ll merely here point out two useful tools for starting to migrate away from CAs.

The first is a short snippet for creating the TLSA DNS record you’ll need:

$ echo 3 0 1 $(echo | openssl s_client -connect thusoy.com:443 | sed -n '/-B/,/-E/p' | openssl x509 -outform DER | sha256sum | cut -d' ' -f1)
depth=2 C = GB, ST = Greater Manchester, L = Salford, O = COMODO CA Limited, CN = COMODO RSA Certification Authority
verify error:num=20:unable to get local issuer certificate
verify return:0
DONE
3 0 1 debe8c60a067a7a648b07c96708d0e224cf7c06fd58840d2083c305e2d70e9fa

Replace sha256sum with shasum -a 256 if you’re on OSX.

Replace thusoy.com with whatever domain you want to compute the DNS record for. The important part here is seeing return:0 before the DONE, and then whatever follows you put as a TLSA record under _443._tcp. and you’re good to go!

Note that this grabs the certificate over the web and verifies it with the CA system, if you don’t have a CA-signed certificate or don’t want to rely on it to compute your TLSA record, it gets even simpler:

$ echo 3 0 1 $(openssl x509 -in  -outform DER | sha256sum | cut -d' ' -f1)

The other thing I wanted to share is this DNSSEC/TLSA Validator plugin, which gives you the status of DNSSEC and TLSA records directly in the address bar of your browser:

Note that it’s merely a status display, the connection is still validated with the CA system and will not be terminated if the TLSA record doesn’t match, but at least it enables developers to deploy DANE in preparation for the time when browsers finally enable it in their core. Mozilla has down-prioritized this since 2011, but if a larger percentage of sites can properly authenticate themselves using DANE it’s harder for browsers to ignore the issue.