IPFYI
RFC 6698 Proposed Standard

The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA

P. Hoffman, J. Schlyter · 2012-08

Abstract

Encrypted communication on the Internet often uses Transport Layer Security (TLS), which depends on third parties to certify the keys used. This document improves on that situation by enabling the administrators of domain names to specify the keys used in that domain's TLS servers. This requires matching improvements in TLS client software, but no change in TLS server software.

Why This RFC Matters

RFC 6698 introduced DANE, allowing domain operators to publish TLS certificate constraints directly in DNSSEC-signed DNS records (TLSA records), creating a second trust anchor independent of the CA ecosystem. This provides a defense against rogue or compromised certificate authorities issuing fraudulent certificates for domains they do not control — a known attack vector that DANE eliminates for DNSSEC-enabled domains. DANE is widely adopted for email (SMTP MTA-STS complement), and the TLSA record type is increasingly used alongside Certificate Transparency to strengthen the web PKI.

관련 프로토콜

SSL-TLS DNS HTTPS DNSSEC

관련 용어

ssl-tls certificate authentication dns encryption

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)