TLSA generator

This tool can be used to generate a TLSA DNS record. TLSA records are required by DANE. It will fetch the certificates of the URL which then can be selected. If there is no URL available use "certificate" and enter the cerificate manually.

Generate from URL / Certificate Fetch certificate info

Certificate:

Usage Field:
PKIX-TA: Certificate Authority Constraint (value 0)
PKIX-EE: Service Certificate Constraint (value 1)
DANE-TA: Trust Anchor Assertion (value 2)
DANE-EE: Domain Issued Certificate (value 3)

Selector Field:
Cert: Use full certificate (value 0)
SPKI: Use subject public key (value 1)

Matching-Type Field:
Full: No Hash (value 0)
SHA-256: SHA-256 hash (value 1)
SHA-512: SHA-512 hash (value 2)

Port Number:
Transport Protocol:
Domain Name:

more information:

• https://tools.ietf.org/html/rfc6698
• https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities