Executive Summary: When using LE certificates, which feature 90-day expirations and automated renewal, be sure to avoid publishing “3 0 1” and “3 0 2” DANE TLSA records. Automated renewal of LE certificates will result in a new certificate digest (fingerprint) and willl invalidate your TLSA records. …

Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates

jared.m September 10, 2018, 7:54pm 17

Good point, fixed! Thanks!

Topic		Replies	Views
DANE and upcoming LE issuer certs Issuance Tech	18	5995	November 25, 2020
TLSA record hygiene for Let's Encrypt issuer CAs Issuance Tech	17	316	July 17, 2025
Understanding SMTP DANE implementation options Issuance Tech	13	5646	October 14, 2022
A DANE-friendly Certbot workflow Help	4	2197	September 23, 2021
TLSA record changes with every renewal process which breaks DANE Help	9	5891	March 2, 2021