DANE - Revision history

Tom at 23:00, 20 September 2024

2024-09-20T23:00:49Z

Tom: /* Solutions */

2024-07-14T22:05:03Z

‎Solutions

Tom at 21:59, 14 July 2024

2024-07-14T21:59:50Z

Tom at 21:54, 14 July 2024

2024-07-14T21:54:09Z

Tom: /* References */

2024-07-14T21:51:25Z

‎References

Tom: /* Context */

2024-07-12T22:38:50Z

‎Context

Tom: /* References */

2024-07-12T22:38:06Z

‎References

Tom: /* Full Title or Meme */

2024-07-12T22:37:26Z

‎Full Title or Meme

Tom: Created page with "==Full Title or Meme== One option to DNS and TLS is DANE DNS-Based Authentication of Named Entities ==Context== 1. DNSSEC: DANE relies on DNSSEC (Domain Name System Se..."

2024-07-12T22:34:46Z

Created page with "==Full Title or Meme== One option to DNS and TLS is DANE DNS-Based Authentication of Named Entities ==Context== 1. **DNSSEC**: DANE relies on DNSSEC (Domain Name System Se..."

New page

==Full Title or Meme==
One option to DNS and TLS is [[DANE]] DNS-Based Authentication of Named Entities
==Context==
1. **DNSSEC**: DANE relies on DNSSEC (Domain Name System Security Extensions), which creates a cryptographically-signed trust hierarchy for domain names. This hierarchy ensures that DNS responses are validated and secure.

2. **Self-Signed Certificates**: With DANE, domain owners can create their own SSL/TLS certificates for their domains. These self-signed certificates are inserted into the DNS hierarchy of trusted keys. Essentially, the domain owner has full control over certificate issuance.

3. **Revocation**: Revoking a certificate is simpler with DANE. If needed, the domain owner can remove the key from DNS, effectively invalidating the certificate.

However, it's worth noting that DANE adoption has been limited so far. Only a small percentage of domains are DNSSEC-signed, and even fewer publish TLSA records (required for DANE). Additionally, client software support for DANE varies. Chrome, for instance, recently added support for it¹².

Feel free to explore DANE further, and let me know if you have any other questions! 😊

Source: Conversation with Copilot, 7/12/2024
(1) CAA Records: An Alternative to DANE for Protecting SSL ... - DomainTools. https://www.domaintools.com/resources/blog/caa-records-an-alternative-to-dane-for-protecting-ssl-tls-certificate-users/.
(2) How does the DANE protocol make Certificate Authorities obsolete?. https://security.stackexchange.com/questions/151960/how-does-the-dane-protocol-make-certificate-authorities-obsolete.
(3) What alternatives are there to the existing Certificate Authority .... https://security.stackexchange.com/questions/23648/what-alternatives-are-there-to-the-existing-certificate-authority-system-for-ssl.

==References==

[[Category: Networking]]

@@ Line 5: / Line 5: @@
 . **DNSSEC**: DANE relies on DNSSEC (Domain Name System Security Extensions), which creates a cryptographically-signed trust hierarchy for domain names. This hierarchy ensures that DNS responses are validated and secure.
-. **Self-Signed Certificates**: With DANE, domain owners can create their own SSL/TLS certificates for their domains. These self-signed certificates are inserted into the DNS hierarchy of trusted keys. Essentially, the domain owner has full control over certificate issuance.
+. **Self-Signed Certificates**: With DANE, domain owners can create their own [[TLS]] (SSL) certificates for their domains. These self-signed certificates are inserted into the DNS hierarchy of trusted keys. Essentially, the domain owner has full control over certificate issuance.
 . **Revocation**: Revoking a certificate is simpler with DANE. If needed, the domain owner can remove the key from DNS, effectively invalidating the certificate.
-Only a small percentage of domains are DNSSEC-signed, and even fewer publish TLSA records (required for DANE). Additionally, client software support for DANE varies. Chrome, for instance, recently added support for it¹².
+Only a small percentage of domains are DNSSEC-signed, and even fewer publish [[TLSA]] records (required for DANE). Additionally, client software support for DANE varies. Chrome, for instance, recently added support for it¹².
 Source: Conversation with Copilot, 7/12/2024
@@ Line 17: / Line 17: @@
 ==Problems==
-While no major browsers natively support [[DANE]] yet, some browsers may offer support through plugins or extensions. The same applies to other software, such as email clients1. If you’re interested in experimenting with DANE, you can explore projects like Let’s DANE, which enables DANE usage with self-signed certificates.<ref>https://github.com/buffrr/letsdane</ref> However, keep in mind that DANE has essentially no deployment on the web, and no browser currently supports it in either the main DNSSEC or the TLS extension mode.
+While no major browsers natively support [[DANE]] yet, some browsers may offer support through plugins or extensions. The same applies to other software, such as email clients1. If you’re interested in experimenting with DANE, you can explore projects like Let’s DANE, which enables DANE usage with self-signed certificates.<ref>https://github.com/buffrr/letsdane</ref> However, keep in mind that DANE has essentially no deployment on the web, and no browser currently supports it in either the main DNSSEC or the [[TLS]] extension mode.
 Learn more on infoblox.com

@@ Line 22: / Line 22: @@
 ==Solutions==
 *See wiki page on [[OpenID 2.0]] for an example of a standard that support personal web sites.
 ==References==

@@ Line 17: / Line 17: @@
 ==Problems==
-While no major browsers natively support DANE (DNS-Based Authentication of Named Entities) yet, some browsers may offer support through plugins or extensions. The same applies to other software, such as email clients1. If you’re interested in experimenting with DANE, you can explore projects like Let’s DANE, which enables DANE usage with self-signed certificates2. However, keep in mind that DANE has essentially no deployment on the web, and no browser currently supports it in either the main DNSSEC or the TLS extension mode.
+While no major browsers natively support [[DANE]] yet, some browsers may offer support through plugins or extensions. The same applies to other software, such as email clients1. If you’re interested in experimenting with DANE, you can explore projects like Let’s DANE, which enables DANE usage with self-signed certificates.<ref>https://github.com/buffrr/letsdane</ref> However, keep in mind that DANE has essentially no deployment on the web, and no browser currently supports it in either the main DNSSEC or the TLS extension mode.
 Learn more on infoblox.com
 ==Solutions==
-*See wiki page on [[OpenID 2.0]]
+*See wiki page on [[OpenID 2.0]] for an example of a standard that support personal web sites.
 ==References==

← Older revision		Revision as of 22:38, 12 July 2024
Line 10:		Line 10:

	However, it's worth noting that DANE adoption has been limited so far. Only a small percentage of domains are DNSSEC-signed, and even fewer publish TLSA records (required for DANE). Additionally, client software support for DANE varies. Chrome, for instance, recently added support for it¹².		However, it's worth noting that DANE adoption has been limited so far. Only a small percentage of domains are DNSSEC-signed, and even fewer publish TLSA records (required for DANE). Additionally, client software support for DANE varies. Chrome, for instance, recently added support for it¹².
−
−	~~Feel free to explore DANE further, and let me know if you have any other questions! 😊~~

	Source: Conversation with Copilot, 7/12/2024		Source: Conversation with Copilot, 7/12/2024

← Older revision		Revision as of 22:38, 12 July 2024
Line 21:		Line 21:

	[[Category: Networking]]		[[Category: Networking]]
		+	[[Category: Identifier]]

@@ Line 15: / Line 15: @@
   (2) How does the DANE protocol make Certificate Authorities obsolete?. https://security.stackexchange.com/questions/151960/how-does-the-dane-protocol-make-certificate-authorities-obsolete.
   (3) What alternatives are there to the existing Certificate Authority .... https://security.stackexchange.com/questions/23648/what-alternatives-are-there-to-the-existing-certificate-authority-system-for-ssl.
 ==References==

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-One option to DNS and TLS is [[DANE]] DNS-Based Authentication of Named Entities
+One option to [[DNS]] and [[TLS]] is [[DANE]] DNS-Based Authentication of Named Entities
 ==Context==
 . **DNSSEC**: DANE relies on DNSSEC (Domain Name System Security Extensions), which creates a cryptographically-signed trust hierarchy for domain names. This hierarchy ensures that DNS responses are validated and secure.

DANE - Revision history

Tom at 23:00, 20 September 2024

Tom: /* Solutions */

Tom at 21:59, 14 July 2024

Tom at 21:54, 14 July 2024

Tom: /* References */

Tom: /* Context */

Tom: /* References */

Tom: /* Full Title or Meme */

Tom: Created page with "==Full Title or Meme== One option to DNS and TLS is DANE DNS-Based Authentication of Named Entities ==Context== 1. **DNSSEC**: DANE relies on DNSSEC (Domain Name System Se..."

Tom: Created page with "==Full Title or Meme== One option to DNS and TLS is DANE DNS-Based Authentication of Named Entities ==Context== 1. DNSSEC: DANE relies on DNSSEC (Domain Name System Se..."