1danetool(1) User Commands danetool(1)
2
6 danetool - GnuTLS DANE tool
7
9 danetool [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 All arguments must be options.
12
14 Tool to generate and check DNS resource records for the DANE protocol.
15
18 -d num, --debug=num
19 Enable debugging. This option takes an integer number as its
20 argument. The value of num is constrained to being:
21 in the range 0 through 9999
22 Specifies the debug level.
24 -V, --verbose
26 More verbose output.
27 --outfile=str
30 Output file.
31 --load-pubkey=str
34 Loads a public key file.
35 This can be either a file or a PKCS #11 URL
37 --load-certificate=str
39 Loads a certificate file.
40 This can be either a file or a PKCS #11 URL
42 --dlv=str
44 Sets a DLV file.
45 This sets a DLV file to be used for DNSSEC verification.
47 --hash=str
49 Hash algorithm to use for signing.
50 Available hash functions are SHA1, RMD160, SHA256, SHA384,
52 SHA512.
53 --check=str
55 Check a host's DANE TLSA entry.
56 Obtains the DANE TLSA entry from the given hostname and prints
58 information. Note that the actual certificate of the host can be
59 provided using --load-certificate, otherwise danetool will con‐
60 nect to the server to obtain it. The exit code on verification
61 success will be zero.
62 --check-ee
64 Check only the end-entity's certificate.
65 Checks the end-entity's certificate only. Trust anchors or CAs
67 are not considered.
68 --check-ca
70 Check only the CA's certificate.
71 Checks the trust anchor's and CA's certificate only. End-enti‐
73 ties are not considered.
74 --tlsa-rr
76 Print the DANE RR data on a certificate or public key. This op‐
77 tion must appear in combination with the following options:
78 host.
79 This command prints the DANE RR data needed to enable DANE on a
81 DNS server.
82 --host=hostname
84 Specify the hostname to be used in the DANE RR.
85 This command sets the hostname for the DANE RR.
87 --proto=protocol
89 The protocol set for DANE data (tcp, udp etc.).
90 This command specifies the protocol for the service set in the
92 DANE data.
93 --port=str
95 The port or service to connect to, for DANE data.
96 --app-proto
99 This is an alias for the --starttls-proto option.
100 --starttls-proto=str
102 The application protocol to be used to obtain the server's cer‐
103 tificate (https, ftp, smtp, imap, ldap, xmpp, lmtp, pop3, nntp,
104 sieve, postgres).
105 When the server's certificate isn't provided danetool will con‐
107 nect to the server to obtain the certificate. In that case it is
108 required to know the protocol to talk with the server prior to
109 initiating the TLS handshake.
110 --ca Whether the provided certificate or public key is a Certificate
112 Authority.
113 Marks the DANE RR as a CA certificate if specified.
115 --x509 Use the hash of the X.509 certificate, rather than the public
117 key.
118 This option forces the generated record to contain the hash of
120 the full X.509 certificate. By default only the hash of the pub‐
121 lic key is used.
122 --local
124 This is an alias for the --domain option.
125 --domain, --no-domain
127 The provided certificate or public key is issued by the local
128 domain. The no-domain form will disable the option. This op‐
129 tion is enabled by default.
130 DANE distinguishes certificates and public keys offered via the
132 DNSSEC to trusted and local entities. This flag indicates that
133 this is a domain-issued certificate, meaning that there could be
134 no CA involved.
135 --local-dns, --no-local-dns
137 Use the local DNS server for DNSSEC resolving. The no-local-dns
138 form will disable the option.
139 This option will use the local DNS server for DNSSEC. This is
141 disabled by default due to many servers not allowing DNSSEC.
142 --insecure
144 Do not verify any DNSSEC signature.
145 Ignores any DNSSEC signature verification results.
147 --inder, --no-inder
149 Use DER format for input certificates and private keys. The
150 no-inder form will disable the option.
151 The input files will be assumed to be in DER or RAW format. Un‐
153 like options that in PEM input would allow multiple input data
154 (e.g. multiple certificates), when reading in DER format a sin‐
155 gle data structure is read.
156 --inraw
158 This is an alias for the --inder option.
159 --print-raw, --no-print-raw
161 Print the received DANE data in raw format. The no-print-raw
162 form will disable the option.
163 This option will print the received DANE data.
165 --quiet
167 Suppress several informational messages.
168 In that case on the exit code can be used as an indication of
170 verification success
171 -v arg, --version=arg
173 Output version of program and exit. The default mode is `v', a
174 simple version. The `c' mode will print copyright information
175 and `n' will print the full copyright notice.
176 -h, --help
178 Display usage information and exit.
179 -!, --more-help
181 Pass the extended usage information through a pager.
182
186 DANE TLSA RR generation
187 To create a DANE TLSA resource record for a certificate (or public key)
189 that was issued locally and may or may not be signed by a CA use the
190 following command.
191 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem
192 To create a DANE TLSA resource record for a CA signed certificate,
194 which will be marked as such use the following command.
195 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem --no-domain
196 The former is useful to add in your DNS entry even if your certificate
198 is signed by a CA. That way even users who do not trust your CA will be
199 able to verify your certificate using DANE.
200 In order to create a record for the CA signer of your certificate use
202 the following.
203 $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem --ca --no-domain
204 To read a server's DANE TLSA entry, use:
206 $ danetool --check www.example.com --proto tcp --port 443
207 To verify an HTTPS server's DANE TLSA entry, use:
209 $ danetool --check www.example.com --proto tcp --port 443 --load-certificate chain.pem
210 To verify an SMTP server's DANE TLSA entry, use:
212 $ danetool --check www.example.com --proto tcp --starttls-proto=smtp --load-certificate chain.pem
213
215 One of the following exit values will be returned:
216 0 (EXIT_SUCCESS)
218 Successful program execution.
219 1 (EXIT_FAILURE)
221 The operation failed or the command syntax was not valid.
222
224 certtool (1)
225
228 Copyright (C) 2020-2023 Free Software Foundation, and others all rights
229 reserved. This program is released under the terms of the GNU General
230 Public License, version 3 or later
231
233 Please send bug reports to: bugs@gnutls.org
2343.8.2 15 Nov 2023 danetool(1)