Skip to main content

Create DANE TLSA Records for Certificate Pinning Generate DANE TLSA DNS records for certificate authentication.

DANE/TLSA Record Generator illustration
🔐

DANE/TLSA Record Generator

Generate DANE TLSA DNS records for certificate authentication.

1

Enter hostname and port

Type your domain in the hostname field and the port number (e.g. 443 for HTTPS, 25 for SMTP).

2

Set usage, selector, and matching

Choose usage (3 for DANE-EE), selector (0 or 1), and matching type (1 for SHA-256 recommended).

3

Generate and copy TLSA

Paste certificate data, click Generate, then copy the record from the output.

Loading tool...

What Is DANE/TLSA Record Generator?

A DANE/TLSA Record Generator is a tool that creates DNS-based records to associate TLS certificates with specific domain names and ports, enabling secure connections through cert pinning. It's primarily used by system administrators and developers who need to configure secure connections for their applications, particularly those requiring strict certificate validation. One specific problem it solves is the complexity of generating correct TLSA record formats, which can be error-prone when done manually.

The tool generates records in the format "_<port>._tcp.<hostname> IN TLSA <usage> <selector> <matching> <hash>", where the hash is derived from the provided certificate data. What makes this tool different is its ability to accept a certificate hash, calculate the SHA-256 digest if necessary, and output the resulting TLSA record in a format ready for DNS configuration. It also features an option to copy the generated record directly to the clipboard.

It supports various input parameters such as hostname, port number, usage, selector, and matching type, allowing users to customize the TLSA record according to their specific requirements. By using it, administrators can ensure that their DANE/TLSA records are correctly formatted and function as intended for secure connections, thus facilitating DNS-based certificate validation through dane tlsa records stored in dnssec-protected zones.

Why Use DANE/TLSA Record Generator?

  • All TLSA types
  • SHA-256 hashing
  • Standard format
  • Free

Common Use Cases

Cert Pinning

Pin via DNS.

SMTP

Email TLS.

DNSSEC

Add cert validation.

Dev

Test config.

Technical Guide

The tool works by using the `crypto.subtle.digest` browser API to calculate the SHA-256 digest of the provided certificate data when necessary. It first removes any whitespace and PEM header/footer from the input data, then converts it to a Uint8Array using the `atob` function and `charCodeAt` method. If the matching type is set to 1 (SHA-256) and the cert data length exceeds 64 characters, it attempts to calculate the SHA-256 digest of the certificate bytes. The resulting hash is then formatted into the TLSA record string along with other input parameters such as hostname, port number, usage, selector, and matching type.

The React `useState` hook is used to manage the state of various input fields including hostname, port, usage, selector, matching, cert data, output, and copied status. When the generate button is clicked, it triggers the `generate` function which updates the output state with the generated TLSA record string in the format "_<port>._tcp.<hostname> IN TLSA <usage> <selector> <matching> <hash>". The tool also utilizes the `copyToClipboard` utility function to copy the generated record directly to the clipboard when the copy button is clicked. This functionality relies on the browser's ability to support asynchronous clipboard operations.

The input parameters are validated and sanitized before being used in the TLSA record generation process, ensuring that only valid data is processed. For example, the port number is parsed as an integer using `parseInt` with a default value of 443 if the input cannot be parsed. The React `useCallback` hook is used to memoize the `generate` and `copy` functions so they are not recreated unnecessarily on every render cycle, improving performance by reducing unnecessary computations.

Tips & Best Practices

  • 1
    Generate TLSA records by pasting certificate hashes into the textarea and clicking the Generate button
  • 2
    Specify ports other than 443 by entering a custom value in the Port input field
  • 3
    Copy generated TLSA records to your clipboard using the Copy button
  • 4
    Select different usage and selector values from the dropdown menus to customize cert pinning behavior
  • 5
    Hash certificates longer than 64 characters using SHA-256 digest when matching type is set to 1

Related Tools

Frequently Asked Questions

Q Is the DANE TLSA generator free?
Yes. The tool is free and runs entirely in your browser.
Q What is DANE?
DANE (DNS-Based Authentication of Named Entities) uses DNS to publish certificate data for TLS validation.
Q Is DNSSEC required for TLSA?
Yes. DNSSEC must be enabled on your domain for TLSA records to be trusted.
Q Which usage value should I use?
Usage 3 (DANE-EE) is most common for certificate pinning.
Q Can I use this on mobile?
Yes. The tool works in any modern browser on desktop or mobile.

About This Tool

DANE/TLSA Record Generator is a free online tool by FreeToolkit.ai. All processing happens directly in your browser — your data never leaves your device. No registration or installation required.