DNS-Based Authentication of Named Entities (DANE) Parameters

Created

  • 2012-06-28

Last Updated

  • 2026-10-06

Available Formats

TLSA Certificate Usages

Registration Procedure(s)

  • RFC Required

Reference

  • RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
  • RFC 7218: Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)

Available Formats

Value Acronym Short Description Reference
0 PKIX-TA CA constraint RFC 6698
1 PKIX-EE Service certificate constraint RFC 6698
2 DANE-TA Trust anchor assertion RFC 6698
3 DANE-EE Domain-issued certificate RFC 6698
4-254 Unassigned
255 PrivCert Reserved for Private Use RFC 6698

TLSA Selectors

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Viktor Dukhovni, Shumon Huque, Paul Wouters

Reference

  • RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
  • RFC 7218: Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)

Available Formats

Value Acronym Short Description Reference
0 Cert Full certificate RFC 6698
1 SPKI SubjectPublicKeyInfo RFC 6698
2 C509 C509Certificate RFC-ietf-cose-cbor-encoded-cert-21
3-254 Unassigned
255 PrivSel Reserved for Private Use RFC 6698

TLSA Matching Types

Registration Procedure(s)

  • Specification Required

Expert(s)

  • Unassigned

Reference

  • RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA
  • RFC 7218: Adding Acronyms to Simplify Conversations about DNS-Based Authentication of Named Entities (DANE)

Available Formats

Value Acronym Short Description Reference
0 Full No hash used RFC 6698
1 SHA2-256 256 bit hash by SHA2 RFC 6234
2 SHA2-512 512 bit hash by SHA2 RFC 6234
3-254 Unassigned
255 PrivMatch Reserved for Private Use RFC 6698