1danetool(1) User Commands danetool(1)
2
6 danetool - GnuTLS DANE tool
7
9 danetool [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 All arguments must be options.
12
15 Tool to generate and check DNS resource records for the DANE protocol.
16
18 -d number, --debug=number
19 Enable debugging. This option takes an integer number as its
20 argument. The value of number is constrained to being:
21 in the range 0 through 9999
22 Specifies the debug level.
24 -V, --verbose
26 More verbose output. This option may appear an unlimited number
27 of times.
28 --infile=file
31 Input file.
32 --outfile=string
35 Output file.
36 --load-pubkey=string
39 Loads a public key file.
40 This can be either a file or a PKCS #11 URL
42 --load-certificate=string
44 Loads a certificate file.
45 This can be either a file or a PKCS #11 URL
47 --dlv=string
49 Sets a DLV file.
50 This sets a DLV file to be used for DNSSEC verification.
52 --hash=string
54 Hash algorithm to use for signing.
55 Available hash functions are SHA1, RMD160, SHA256, SHA384,
57 SHA512.
58 --check=string
60 Check a host's DANE TLSA entry.
61 Obtains the DANE TLSA entry from the given hostname and prints
63 information. Note that the actual certificate of the host can be
64 provided using --load-certificate, otherwise danetool will con‐
65 nect to the server to obtain it. The exit code on verification
66 success will be zero.
67 --check-ee
69 Check only the end-entity's certificate.
70 Checks the end-entity's certificate only. Trust anchors or CAs
72 are not considered.
73 --check-ca
75 Check only the CA's certificate.
76 Checks the trust anchor's and CA's certificate only. End-enti‐
78 ties are not considered.
79 --tlsa-rr
81 Print the DANE RR data on a certificate or public key. This
82 option must appear in combination with the following options:
83 host.
84 This command prints the DANE RR data needed to enable DANE on a
86 DNS server.
87 --host=hostname
89 Specify the hostname to be used in the DANE RR.
90 This command sets the hostname for the DANE RR.
92 --proto=protocol
94 The protocol set for DANE data (tcp, udp etc.).
95 This command specifies the protocol for the service set in the
97 DANE data.
98 --port=number
100 Specify the port number for the DANE data. This option takes an
101 integer number as its argument.
102 --app-proto=string
105 The application protocol to be used to obtain the server's cer‐
106 tificate (https, ftp, smtp, imap).
107 When the server's certificate isn't provided danetool will con‐
109 nect to the server to obtain the certificate. In that case it is
110 required to known the protocol to talk with the server prior to
111 initiating the TLS handshake.
112 --ca Whether the provided certificate or public key is a Certificate
114 Authority.
115 Marks the DANE RR as a CA certificate if specified.
117 --x509 Use the hash of the X.509 certificate, rather than the public
119 key.
120 This option forces the generated record to contain the hash of
122 the full X.509 certificate. By default only the hash of the pub‐
123 lic key is used.
124 --local
126 This is an alias for the --domain option.
127 --domain, --no-domain
129 The provided certificate or public key is issued by the local
130 domain. The no-domain form will disable the option. This
131 option is enabled by default.
132 DANE distinguishes certificates and public keys offered via the
134 DNSSEC to trusted and local entities. This flag indicates that
135 this is a domain-issued certificate, meaning that there could be
136 no CA involved.
137 --local-dns, --no-local-dns
139 Use the local DNS server for DNSSEC resolving. The no-local-dns
140 form will disable the option.
141 This option will use the local DNS server for DNSSEC. This is
143 disabled by default due to many servers not allowing DNSSEC.
144 --insecure
146 Do not verify any DNSSEC signature.
147 Ignores any DNSSEC signature verification results.
149 --inder, --no-inder
151 Use DER format for input certificates and private keys. The
152 no-inder form will disable the option.
153 The input files will be assumed to be in DER or RAW format.
155 Unlike options that in PEM input would allow multiple input data
156 (e.g. multiple certificates), when reading in DER format a sin‐
157 gle data structure is read.
158 --inraw
160 This is an alias for the --inder option.
161 --print-raw, --no-print-raw
163 Print the received DANE data in raw format. The no-print-raw
164 form will disable the option.
165 This option will print the received DANE data.
167 --quiet
169 Suppress several informational messages.
170 In that case on the exit code can be used as an indication of
172 verification success
173 -h, --help
175 Display usage information and exit.
176 -!, --more-help
178 Pass the extended usage information through a pager.
179 -v [{v|c|n --version [{v|c|n}]}]
181 Output version of program and exit. The default mode is `v', a
182 simple version. The `c' mode will print copyright information
183 and `n' will print the full copyright notice.
184
186 DANE TLSA RR generation
187 To create a DANE TLSA resource record for a certificate (or public key)
189 that was issued localy and may or may not be signed by a CA use the
190 following command.
191 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem
192 To create a DANE TLSA resource record for a CA signed certificate,
194 which will be marked as such use the following command.
195 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem --no-domain
196 The former is useful to add in your DNS entry even if your certificate
198 is signed by a CA. That way even users who do not trust your CA will be
199 able to verify your certificate using DANE.
200 In order to create a record for the CA signer of your certificate use
202 the following.
203 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem --ca --no-domain
204 To read a server's DANE TLSA entry, use:
206 $ danetool --check www.example.com --proto tcp --port 443
207 To verify a server's DANE TLSA entry, use:
209 $ danetool --check www.example.com --proto tcp --port 443 --load-certificate chain.pem
210
212 One of the following exit values will be returned:
213 0 (EXIT_SUCCESS)
215 Successful program execution.
216 1 (EXIT_FAILURE)
218 The operation failed or the command syntax was not valid.
219 70 (EX_SOFTWARE)
221 libopts had an internal operational error. Please report it to
222 autogen-users@lists.sourceforge.net. Thank you.
223
225 certtool (1)
226
228 Nikos Mavrogiannopoulos, Simon Josefsson and others; see
229 /usr/share/doc/gnutls/AUTHORS for a complete list.
230
232 Copyright (C) 2000-2018 Free Software Foundation, and others all rights
233 reserved. This program is released under the terms of the GNU General
234 Public License, version 3 or later.
235
237 Please send bug reports to: bugs@gnutls.org
238
240 This manual page was AutoGen-erated from the danetool option defini‐
241 tions.
2423.3.29 16 Feb 2018 danetool(1)