1danetool(1)                      User Commands                     danetool(1)
2
3
4

NAME

6       danetool - GnuTLS DANE tool
7

SYNOPSIS

9       danetool [-flags] [-flag [value]] [--option-name[[=| ]value]]
10
11       All arguments must be options.
12

DESCRIPTION

14       Tool to generate and check DNS resource records for the DANE protocol.
15
16

OPTIONS

18       -d num, --debug=num
19              Enable  debugging.   This  option takes an integer number as its
20              argument.  The value of num is constrained to being:
21                  in the range 0 through 9999
22
23              Specifies the debug level.
24
25       -V, --verbose
26              More verbose output.
27
28
29       --outfile=str
30              Output file.
31
32
33       --load-pubkey=str
34              Loads a public key file.
35
36              This can be either a file or a PKCS #11 URL
37
38       --load-certificate=str
39              Loads a certificate file.
40
41              This can be either a file or a PKCS #11 URL
42
43       --dlv=str
44              Sets a DLV file.
45
46              This sets a DLV file to be used for DNSSEC verification.
47
48       --hash=str
49              Hash algorithm to use for signing.
50
51              Available hash functions are SHA1, RMD160, SHA256, SHA384,
52              SHA512.
53
54       --check=str
55              Check a host's DANE TLSA entry.
56
57              Obtains the DANE TLSA entry from the given hostname and prints
58              information. Note that the actual certificate of the host can be
59              provided using --load-certificate, otherwise danetool will con‐
60              nect to the server to obtain it. The exit code on verification
61              success will be zero.
62
63       --check-ee
64              Check only the end-entity's certificate.
65
66              Checks the end-entity's certificate only. Trust anchors or CAs
67              are not considered.
68
69       --check-ca
70              Check only the CA's certificate.
71
72              Checks the trust anchor's and CA's certificate only. End-enti‐
73              ties are not considered.
74
75       --tlsa-rr
76              Print the DANE RR data on a certificate or public key.  This op‐
77              tion must appear in combination with the following options:
78              host.
79
80              This command prints the DANE RR data needed to enable DANE on a
81              DNS server.
82
83       --host=hostname
84              Specify the hostname to be used in the DANE RR.
85
86              This command sets the hostname for the DANE RR.
87
88       --proto=protocol
89              The protocol set for DANE data (tcp, udp etc.).
90
91              This command specifies the protocol for the service set in the
92              DANE data.
93
94       --port=str
95              The port or service to connect to, for DANE data.
96
97
98       --app-proto
99              This is an alias for the --starttls-proto option.
100
101       --starttls-proto=str
102              The application protocol to be used to obtain the server's cer‐
103              tificate (https, ftp, smtp, imap, ldap, xmpp, lmtp, pop3, nntp,
104              sieve, postgres).
105
106              When the server's certificate isn't provided danetool will con‐
107              nect to the server to obtain the certificate. In that case it is
108              required to know the protocol to talk with the server prior to
109              initiating the TLS handshake.
110
111       --ca   Whether the provided certificate or public key is a Certificate
112              Authority.
113
114              Marks the DANE RR as a CA certificate if specified.
115
116       --x509 Use the hash of the X.509 certificate, rather than the public
117              key.
118
119              This option forces the generated record to contain the hash of
120              the full X.509 certificate. By default only the hash of the pub‐
121              lic key is used.
122
123       --local
124              This is an alias for the --domain option.
125
126       --domain, --no-domain
127              The provided certificate or public key is issued by the local
128              domain.  The no-domain form will disable the option.  This op‐
129              tion is enabled by default.
130
131              DANE distinguishes certificates and public keys offered via the
132              DNSSEC to trusted and local entities. This flag indicates that
133              this is a domain-issued certificate, meaning that there could be
134              no CA involved.
135
136       --local-dns, --no-local-dns
137              Use the local DNS server for DNSSEC resolving.  The no-local-dns
138              form will disable the option.
139
140              This option will use the local DNS server for DNSSEC.  This is
141              disabled by default due to many servers not allowing DNSSEC.
142
143       --insecure
144              Do not verify any DNSSEC signature.
145
146              Ignores any DNSSEC signature verification results.
147
148       --inder, --no-inder
149              Use DER format for input certificates and private keys.  The
150              no-inder form will disable the option.
151
152              The input files will be assumed to be in DER or RAW format.  Un‐
153              like options that in PEM input would allow multiple input data
154              (e.g. multiple certificates), when reading in DER format a sin‐
155              gle data structure is read.
156
157       --inraw
158              This is an alias for the --inder option.
159
160       --print-raw, --no-print-raw
161              Print the received DANE data in raw format.  The no-print-raw
162              form will disable the option.
163
164              This option will print the received DANE data.
165
166       --quiet
167              Suppress several informational messages.
168
169              In that case on the exit code can be used as an indication of
170              verification success
171
172       -v arg, --version=arg
173              Output version of program and exit.  The default mode is `v', a
174              simple version.  The `c' mode will print copyright information
175              and `n' will print the full copyright notice.
176
177       -h, --help
178              Display usage information and exit.
179
180       -!, --more-help
181              Pass the extended usage information through a pager.
182
183
184

EXAMPLES

186       DANE TLSA RR generation
187
188       To create a DANE TLSA resource record for a certificate (or public key)
189       that was issued locally and may or may not be signed by a CA use the
190       following command.
191           $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem
192
193       To create a DANE TLSA resource record for a CA signed certificate,
194       which will be marked as such use the following command.
195           $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem   --no-domain
196
197       The former is useful to add in your DNS entry even if your certificate
198       is signed by a CA. That way even users who do not trust your CA will be
199       able to verify your certificate using DANE.
200
201       In order to create a record for the CA signer of your certificate use
202       the following.
203           $ danetool --tlsa-rr --host www.example.com --load-certificate cert.pem   --ca --no-domain
204
205       To read a server's DANE TLSA entry, use:
206           $ danetool --check www.example.com --proto tcp --port 443
207
208       To verify an HTTPS server's DANE TLSA entry, use:
209           $ danetool --check www.example.com --proto tcp --port 443 --load-certificate chain.pem
210
211       To verify an SMTP server's DANE TLSA entry, use:
212           $ danetool --check www.example.com --proto tcp --starttls-proto=smtp --load-certificate chain.pem
213

EXIT STATUS

215       One of the following exit values will be returned:
216
217       0  (EXIT_SUCCESS)
218              Successful program execution.
219
220       1  (EXIT_FAILURE)
221              The operation failed or the command syntax was not valid.
222

SEE ALSO

224       certtool (1)
225

AUTHORS

228       Copyright (C) 2020-2023 Free Software Foundation, and others all rights
229       reserved.  This program is released under the terms of the GNU General
230       Public License, version 3 or later
231

BUGS

233       Please send bug reports to: bugs@gnutls.org
234
235
236
2373.8.2                             15 Nov 2023                      danetool(1)
Impressum