Executive Summary: When using LE certificates, which feature 90-day expirations and automated renewal, be sure to avoid publishing “3 0 1” and “3 0 2” DANE TLSA records. Automated renewal of LE certificates will result in a new certificate digest (fingerprint) and willl invalidate your TLSA records. …

Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates

jared.m September 10, 2018, 7:54pm 17

Good point, fixed! Thanks!

Topic		Replies	Views
DANE and upcoming LE issuer certs Issuance Tech	18	6119	November 25, 2020
TLSA record hygiene for Let's Encrypt issuer CAs Issuance Tech	17	450	July 17, 2025
Understanding SMTP DANE implementation options Issuance Tech	13	6189	October 14, 2022
A DANE-friendly Certbot workflow Help	4	2276	September 23, 2021
TLSA record changes with every renewal process which breaks DANE Help	9	6076	March 2, 2021