Executive Summary: When using LE certificates, which feature 90-day expirations and automated renewal, be sure to avoid publishing “3 0 1” and “3 0 2” DANE TLSA records. Automated renewal of LE certificates will result in a new certificate digest (fingerprint) and willl invalidate your TLSA records. …

Please avoid "3 0 1" and "3 0 2" DANE TLSA records with LE certificates

jared.m September 10, 2018, 7:54pm 17

Good point, fixed! Thanks!

Topic		Replies	Views
A DANE-friendly Certbot workflow Help	4	2072	September 23, 2021
DANE and upcoming LE issuer certs Issuance Tech	18	5880	November 25, 2020
DANE TLSA and reuse-key Help	3	616	January 14, 2024
Current + Next DANE key rollover and rotation for 3 1 1 TLSA records Issuance Tech	1	3246	January 22, 2021
Automating LE certificate renewal for use with DANE Help	1	1356	January 8, 2017