DANE / TLSA

DNS-Based Authentication of Named Entities (RFC 6698, updated by RFC 7671) — match a server certificate against a TLSA record so the DNS, not a public CA, vouches for which key a service uses. This is the payoff of DNSSEC: verify the TLSA RRset with b.network.dns.dnssec first, then matchCertificate checks the certificate against it.

A TLSA record carries a certificate usage (PKIX-TA 0, PKIX-EE 1, DANE-TA 2, DANE-EE 3 — RFC 7218 mnemonics), a selector (full certificate 0, or subjectPublicKeyInfo 1), and a matching type (exact 0, SHA-256 1, SHA-512 2). The selected certificate data is hashed per the matching type and compared, in constant time, to the record's association data. For DANE-EE(3) a match means the certificate IS the pinned end-entity key — no public-CA path is needed (the common SMTP-DANE case, RFC 7672). For the PKIX usages a match is necessary but the caller still performs PKIX validation.

b.network.dns.dane.matchCertificate(opts) #

{
  {
    tlsa: [ { usage, selector, matchingType, data: Buffer|hex } ],  // the TLSA RRset
    certificate: Buffer,   // leaf certificate (DER)
    chain?:      Buffer[],  // intermediate / CA certs (DER), for TA usages
  }
}

Match a server certificate against a set of (DNSSEC-verified) TLSA records (RFC 6698 / 7671). For each record the selected data — the full certificate DER (selector 0) or its subjectPublicKeyInfo (selector 1) — is hashed per the matching type (exact / SHA-256 / SHA-512) and compared, constant-time, to the record's association data. End-entity usages (PKIX-EE 1, DANE-EE 3) are matched against the leaf certificate; trust-anchor usages (PKIX-TA 0, DANE-TA 2) are matched against the leaf and any supplied chain.

Returns the matching record plus what the caller must still do: a DANE-EE match is self-sufficient (the TLSA pins the key); a DANE-TA match still needs chain-to-anchor verification; PKIX usages still need full PKIX validation. Throws dane/no-match if nothing matches. Verify the TLSA RRset with b.network.dns.dnssec before trusting the records — an unauthenticated TLSA proves nothing.

var r = b.network.dns.dane.matchCertificate({ tlsa: records, certificate: leafDer });
// → { ok: true, matched: { usage: 3, selector: 1, matchingType: 1 }, daneAuthenticated: true, pkixRequired: false }

Last updated 2026-08-08T16:39:49.652Z by seeder.