https://nalar.dev/tags/tlsa/ Recent content in TLSA on Nalar Hugo en-us Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/dane-tlsa-binds-tls-service-keys-through-dnssec/ Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/dane-tlsa-binds-tls-service-keys-through-dnssec/ <h1 id="dane-tlsa-binds-tls-service-keys-through-dnssec">DANE TLSA Binds TLS Service Keys Through DNSSEC</h1> <p>TLS normally authenticates a server through certificate validation rules defined by the application and its trust model. DANE adds a DNS-based binding: a TLSA resource record associates a service endpoint with certificate or public-key material, while DNSSEC supplies authenticated DNS data for that association.</p> <p>The boundary is strict. A TLSA RRset that is insecure or has an indeterminate DNSSEC state cannot serve as an authenticated DANE association. DANE therefore depends on DNSSEC validation rather than treating ordinary DNS transport as sufficient evidence.</p>