Create DANE TLSA Records for Certificate Pinning Generate DANE TLSA DNS records for certificate authentication.
DANE/TLSA Record Generator
Generate DANE TLSA DNS records for certificate authentication.
Enter hostname and port
Type your domain in the hostname field and the port number (e.g. 443 for HTTPS, 25 for SMTP).
Set usage, selector, and matching
Choose usage (3 for DANE-EE), selector (0 or 1), and matching type (1 for SHA-256 recommended).
Generate and copy TLSA
Paste certificate data, click Generate, then copy the record from the output.
What Is DANE/TLSA Record Generator?
A DANE/TLSA Record Generator is a tool that creates DNS-based records to associate TLS certificates with specific domain names and ports, enabling secure connections through cert pinning. It's primarily used by system administrators and developers who need to configure secure connections for their applications, particularly those requiring strict certificate validation. One specific problem it solves is the complexity of generating correct TLSA record formats, which can be error-prone when done manually.
The tool generates records in the format "_<port>._tcp.<hostname> IN TLSA <usage> <selector> <matching> <hash>", where the hash is derived from the provided certificate data. What makes this tool different is its ability to accept a certificate hash, calculate the SHA-256 digest if necessary, and output the resulting TLSA record in a format ready for DNS configuration. It also features an option to copy the generated record directly to the clipboard.
It supports various input parameters such as hostname, port number, usage, selector, and matching type, allowing users to customize the TLSA record according to their specific requirements. By using it, administrators can ensure that their DANE/TLSA records are correctly formatted and function as intended for secure connections, thus facilitating DNS-based certificate validation through dane tlsa records stored in dnssec-protected zones.
Why Use DANE/TLSA Record Generator?
-
All TLSA types
-
SHA-256 hashing
-
Standard format
-
Free
Common Use Cases
Cert Pinning
Pin via DNS.
SMTP
Email TLS.
DNSSEC
Add cert validation.
Dev
Test config.
Technical Guide
The tool works by using the `crypto.subtle.digest` browser API to calculate the SHA-256 digest of the provided certificate data when necessary. It first removes any whitespace and PEM header/footer from the input data, then converts it to a Uint8Array using the `atob` function and `charCodeAt` method. If the matching type is set to 1 (SHA-256) and the cert data length exceeds 64 characters, it attempts to calculate the SHA-256 digest of the certificate bytes. The resulting hash is then formatted into the TLSA record string along with other input parameters such as hostname, port number, usage, selector, and matching type.
The React `useState` hook is used to manage the state of various input fields including hostname, port, usage, selector, matching, cert data, output, and copied status. When the generate button is clicked, it triggers the `generate` function which updates the output state with the generated TLSA record string in the format "_<port>._tcp.<hostname> IN TLSA <usage> <selector> <matching> <hash>". The tool also utilizes the `copyToClipboard` utility function to copy the generated record directly to the clipboard when the copy button is clicked. This functionality relies on the browser's ability to support asynchronous clipboard operations.
The input parameters are validated and sanitized before being used in the TLSA record generation process, ensuring that only valid data is processed. For example, the port number is parsed as an integer using `parseInt` with a default value of 443 if the input cannot be parsed. The React `useCallback` hook is used to memoize the `generate` and `copy` functions so they are not recreated unnecessarily on every render cycle, improving performance by reducing unnecessary computations.
Tips & Best Practices
-
1Generate TLSA records by pasting certificate hashes into the textarea and clicking the Generate button
-
2Specify ports other than 443 by entering a custom value in the Port input field
-
3Copy generated TLSA records to your clipboard using the Copy button
-
4Select different usage and selector values from the dropdown menus to customize cert pinning behavior
-
5Hash certificates longer than 64 characters using SHA-256 digest when matching type is set to 1
Related Tools
SHA-256 Hash Generator
Generate SHA-256 hash digests.
🔐 Encoding & Crypto
SPF Record Generator
Generate SPF DNS TXT records for email authentication.
🔐 Encoding & Crypto
DKIM Record Generator
Generate DKIM DNS TXT records for email signing.
🔐 Encoding & Crypto
DMARC Record Generator
Generate DMARC DNS records for email authentication policy.
🔐 Encoding & CryptoFrequently Asked Questions
Q Is the DANE TLSA generator free?
Q What is DANE?
Q Is DNSSEC required for TLSA?
Q Which usage value should I use?
Q Can I use this on mobile?
About This Tool
DANE/TLSA Record Generator is a free online tool by FreeToolkit.ai. All processing happens directly in your browser — your data never leaves your device. No registration or installation required.