Executive Summary: When using LE certificates, which feature 90-day expirations and automated renewal, be sure to avoid publishing “3 0 1” and “3 0 2” DANE TLSA records. Automated renewal of LE certificates will result in a new certificate digest (fingerprint) and willl invalidate your TLSA records. …

Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates

jared.m September 10, 2018, 7:54pm 17

Good point, fixed! Thanks!

Topic		Replies	Views
DANE and upcoming LE issuer certs Issuance Tech	18	6029	November 25, 2020
How to keep the cert hash throughout renewal process? Help	2	5922	March 10, 2016
Automized TLSA and DANE Records Server	0	3717	December 29, 2015
TLSA record changes with every renewal process which breaks DANE Help	9	5956	March 2, 2021
A DANE-friendly Certbot workflow Help	4	2216	September 23, 2021