Executive Summary: When using LE certificates, which feature 90-day expirations and automated renewal, be sure to avoid publishing “3 0 1” and “3 0 2” DANE TLSA records. Automated renewal of LE certificates will result in a new certificate digest (fingerprint) and willl invalidate your TLSA records. …

FYI Internetsociety.org describes another way how to use DANE with Let’S Encrypt: https://www.internetsociety.org/deploy360/blog/2016/01/lets-encrypt-certificates-for-mail-servers-and-dane-part-1-of-2/

[image] rugk: FYI Internetsociety.org describes another way how to use DANE with Let'S Encrypt: I think of it as another exposition of the same way, not so much another way...

I used 2 1 1 with the IdenTrust root. The main disadvantage of this, I think, is that you have to send the root in your certificate chain, which is unusual, but shouldn’t cause any problems.

[image] hlandau: The main disadvantage of this, I think, is that you have to send the root in your certificate chain, which is unusual, but shouldn't cause any problems. Yes, while including root CAs in the chain may be unusual without DANE, it is required with DANE if you want to use a root …

More recently, an updated post describes the recommended approach in much greater detail. In particular, the new post explains how to use the --csr option. Please see: https://www.internetsociety.org/deploy360/blog/2016/03/lets-encrypt-certificates-for-mail-servers-and-dane-part-2-of-2/

Note: the blog contains links to non-HTTPS images, which are therefore blocked and results in “mixed content” in Chromium.

(Here was a comment advocating against 2 1 1. It was written under the wrong assumption that bits 0 and 1 in the certificate usage field were fully orthogonal, i.e., that 2 and 3 (like 0 and 1) only differed in whether the the certificate/key itself was specified or a parent certificate/key (aka CA)…

Indeed, I was wrong. I have thus updated my previous comment to avoid anyone taking it by face value. Thanks for pointing this out, @tdelmas and @ietf-dane .

Ok, so if use '–csr ’ how can i renew the cert it seams to me that is not possible right now with ‘certbot renew’… can i use ‘–reuse-key’ instead to make it work with renew and ‘3 1 1’?

You can use --reuse-key instead of --csr, but the latter prevents you from using renew. You would just need to issue the same command as you did to issue the certificate in order to renew with --csr. --reuse-key uses much more standard Certbot functionality, so it will manage certificates and enabl…

Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates

Server

jared.m September 10, 2018, 7:54pm 17

Good point, fixed! Thanks!

Topic		Replies	Views
DANE and upcoming LE issuer certs Issuance Tech	18	6185	November 25, 2020
TLSA record hygiene for Let's Encrypt issuer CAs Issuance Tech	17	550	July 17, 2025
Understanding SMTP DANE implementation options Issuance Tech	13	6455	October 14, 2022
A DANE-friendly Certbot workflow Help	4	2319	September 23, 2021
TLSA record changes with every renewal process which breaks DANE Help	9	6193	March 2, 2021

Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates

Related topics