DANE+TLSA record generation

Hey,

I've created a TLSA record manager that hooks into certbot internals to handle renewals. It successfully deals with rotating private keys so one doesn't need to pin (reuse) a private key — resulting in an improved OPSEC.

Feel free to use it: karolyi/daneupdate: DANE TLSA records updater using certbot - daneupdate - KSOL Gitea

1 Like

You shouldn't replace certbot renew.

You have no way to control when certbot renew is going to be run, or what's going to run it: cron, systemd, something else? Also, what happens if you have more than one cert, and only use dane on some?

You might want to implement the changes as their own crontab line, or you might look up the at scheduling utility while using certbot's deploy hooks.

Not sure if you pin the end entity certificate or the intermediate, also.

2 Likes

Well, you could read the readme because a lot of your criticisms were addressed there before you've commented here. :slight_smile:

It's a tool I built for myself primarily, but others are free to use it, given it suits their needs.

Yes, you readme shouldn't require me to open the example config to understand what you're doing.

2 Likes

There is sufficient documentation in the readme about how to get it working, and I even hint there at things you were questioning here.

In the end, I suppose it's not for you so just ignore it.

2 Likes