4

What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)?

Secondly, how can I verify that DANE is configured correctly? Either with a local tool or online tool. And are there known Nmap NSE scripts that perform this check?

Bob Ortiz
  • 6,234
  • 8
  • 43
  • 90

2 Answers2

6

DANE allows you (as a domain owner) to specify the possible CA's that are allowed to generate a certificate for your domain. This prevents rogue Ca's to issue a certificate (it will be invalidated by a client that uses DANE to validate the certificate).

From Wikipedia:

DANE enables the administrator of a domain name to certify the keys used in that domain's TLS clients or servers by storing them in the Domain Name System (DNS). DANE needs the DNS records to be signed with DNSSEC for its security model to work.

Here is an online tool that can validate a DANE implementation: https://dane.sys4.de/common_mistakes

oɔɯǝɹ
  • 528
  • 2
  • 6
  • 18
  • 5
    Not only the CA, using DANE it is also possible to specifiy the public key(s) which are allowed for the domain or even the full certificate. – Josef Jul 19 '16 at 11:47
1

The primary goal of DANE is to allow a DNS provider to provide a certificate for a domain as a DNS record. The work performed by a CA now - specifically, domain validation, i.e. matching a public key to a domain - would be done by a DNS provider instead of a CA.

As DNS records are required to be trusted in this scenario, DNSSEC is a requirement for DANE.

mikemaccana
  • 413
  • 3
  • 14
  • Partially true, to trust the certificate it must be signed by a 3rd party, in this case you sign the certificate yourself as the DNS operator following the chain from the root, you operate as an intermediate CA, as opposed to signing the certificate with a public certificate trusted root. `trustworthy` I would disagree, there is no external entity to validate if your certificate is good or malicious. – Jacob Evans May 30 '17 at 12:41
  • 1
    @JacobEvans I've modified my language, as I did not wish to imply that DNS was trustworthy, but merely that DANE trusts DNS and hence the DNSSEC dependency. – mikemaccana May 30 '17 at 12:57