1danetool(1) User Commands danetool(1)
2
6 danetool - GnuTLS DANE tool
7
9 danetool [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 All arguments must be options.
12
15 Tool to generate and check DNS resource records for the DANE protocol.
16
18 -d number, --debug=number
19 Enable debugging. This option takes an integer number as its
20 argument. The value of number is constrained to being:
21 in the range 0 through 9999
22 Specifies the debug level.
24 -V, --verbose
26 More verbose output. This option may appear an unlimited number
27 of times.
28 --infile=file
31 Input file.
32 --outfile=string
35 Output file.
36 --load-pubkey=string
39 Loads a public key file.
40 This can be either a file or a PKCS #11 URL
42 --load-certificate=string
44 Loads a certificate file.
45 This can be either a file or a PKCS #11 URL
47 --dlv=string
49 Sets a DLV file.
50 This sets a DLV file to be used for DNSSEC verification.
52 --hash=string
54 Hash algorithm to use for signing.
55 Available hash functions are SHA1, RMD160, SHA256, SHA384,
57 SHA512.
58 --check=string
60 Check a host's DANE TLSA entry.
61 Obtains the DANE TLSA entry from the given hostname and prints
63 information. Note that the actual certificate of the host can be
64 provided using --load-certificate, otherwise danetool will con‐
65 nect to the server to obtain it. The exit code on verification
66 success will be zero.
67 --check-ee
69 Check only the end-entity's certificate.
70 Checks the end-entity's certificate only. Trust anchors or CAs
72 are not considered.
73 --check-ca
75 Check only the CA's certificate.
76 Checks the trust anchor's and CA's certificate only. End-enti‐
78 ties are not considered.
79 --tlsa-rr
81 Print the DANE RR data on a certificate or public key. This
82 option must appear in combination with the following options:
83 host.
84 This command prints the DANE RR data needed to enable DANE on a
86 DNS server.
87 --host=hostname
89 Specify the hostname to be used in the DANE RR.
90 This command sets the hostname for the DANE RR.
92 --proto=protocol
94 The protocol set for DANE data (tcp, udp etc.).
95 This command specifies the protocol for the service set in the
97 DANE data.
98 --port=string
100 The port or service to connect to, for DANE data.
101 --app-proto
104 This is an alias for the --starttls-proto option.
105 --starttls-proto=string
107 The application protocol to be used to obtain the server's cer‐
108 tificate (https, ftp, smtp, imap, ldap, xmpp, lmtp, pop3, nntp,
109 sieve, postgres).
110 When the server's certificate isn't provided danetool will con‐
112 nect to the server to obtain the certificate. In that case it is
113 required to know the protocol to talk with the server prior to
114 initiating the TLS handshake.
115 --ca Whether the provided certificate or public key is a Certificate
117 Authority.
118 Marks the DANE RR as a CA certificate if specified.
120 --x509 Use the hash of the X.509 certificate, rather than the public
122 key.
123 This option forces the generated record to contain the hash of
125 the full X.509 certificate. By default only the hash of the pub‐
126 lic key is used.
127 --local
129 This is an alias for the --domain option.
130 --domain, --no-domain
132 The provided certificate or public key is issued by the local
133 domain. The no-domain form will disable the option. This
134 option is enabled by default.
135 DANE distinguishes certificates and public keys offered via the
137 DNSSEC to trusted and local entities. This flag indicates that
138 this is a domain-issued certificate, meaning that there could be
139 no CA involved.
140 --local-dns, --no-local-dns
142 Use the local DNS server for DNSSEC resolving. The no-local-dns
143 form will disable the option.
144 This option will use the local DNS server for DNSSEC. This is
146 disabled by default due to many servers not allowing DNSSEC.
147 --insecure
149 Do not verify any DNSSEC signature.
150 Ignores any DNSSEC signature verification results.
152 --inder, --no-inder
154 Use DER format for input certificates and private keys. The
155 no-inder form will disable the option.
156 The input files will be assumed to be in DER or RAW format.
158 Unlike options that in PEM input would allow multiple input data
159 (e.g. multiple certificates), when reading in DER format a sin‐
160 gle data structure is read.
161 --inraw
163 This is an alias for the --inder option.
164 --print-raw, --no-print-raw
166 Print the received DANE data in raw format. The no-print-raw
167 form will disable the option.
168 This option will print the received DANE data.
170 --quiet
172 Suppress several informational messages.
173 In that case on the exit code can be used as an indication of
175 verification success
176 -h, --help
178 Display usage information and exit.
179 -!, --more-help
181 Pass the extended usage information through a pager.
182 -v [{v|c|n --version [{v|c|n}]}]
184 Output version of program and exit. The default mode is `v', a
185 simple version. The `c' mode will print copyright information
186 and `n' will print the full copyright notice.
187
189 DANE TLSA RR generation
190 To create a DANE TLSA resource record for a certificate (or public key)
192 that was issued localy and may or may not be signed by a CA use the
193 following command.
194 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem
195 To create a DANE TLSA resource record for a CA signed certificate,
197 which will be marked as such use the following command.
198 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem --no-domain
199 The former is useful to add in your DNS entry even if your certificate
201 is signed by a CA. That way even users who do not trust your CA will be
202 able to verify your certificate using DANE.
203 In order to create a record for the CA signer of your certificate use
205 the following.
206 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem --ca --no-domain
207 To read a server's DANE TLSA entry, use:
209 $ danetool --check www.example.com --proto tcp --port 443
210 To verify an HTTPS server's DANE TLSA entry, use:
212 $ danetool --check www.example.com --proto tcp --port 443 --load-certificate chain.pem
213 To verify an SMTP server's DANE TLSA entry, use:
215 $ danetool --check www.example.com --proto tcp --starttls-proto=smtp --load-certificate chain.pem
216
218 One of the following exit values will be returned:
219 0 (EXIT_SUCCESS)
221 Successful program execution.
222 1 (EXIT_FAILURE)
224 The operation failed or the command syntax was not valid.
225 70 (EX_SOFTWARE)
227 libopts had an internal operational error. Please report it to
228 autogen-users@lists.sourceforge.net. Thank you.
229
231 certtool (1)
232
234 Nikos Mavrogiannopoulos, Simon Josefsson and others; see
235 /usr/share/doc/gnutls/AUTHORS for a complete list.
236
238 Copyright (C) 2000-2019 Free Software Foundation, and others all rights
239 reserved. This program is released under the terms of the GNU General
240 Public License, version 3 or later.
241
243 Please send bug reports to: bugs@gnutls.org
244
246 This manual page was AutoGen-erated from the danetool option defini‐
247 tions.
2483.6.8 27 May 2019 danetool(1)