🔐

DANE & TLSA: DNS-Based TLS Authentication

Simple

Free preview · 2 of 5 steps

DANE: TLS authentication without trusting CAs

The TLS certificate system relies on ~150 public Certificate Authorities — any one of them can issue a certificate for any domain. This has caused real problems: DigiNotar (2011) issued fraudulent Google certificates, Symantec mis-issued thousands of certs. The browser response was CAA records and Certificate Transparency, but these are reactive.

DANE (RFC 6698) takes a different approach: pin the certificate fingerprint directly in DNS, secured by DNSSEC. A client that checks the TLSA record mathematically verifies the server's certificate before trusting it — no CA involved.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step