howto generate TLSA 0 0 0

Viktor Dukhovni ietf-dane at dukhovni.org
Fri Sep 16 19:24:52 CEST 2016


On Fri, Sep 16, 2016 at 01:39:16PM +0200, Carsten Strotmann (sys4) wrote:

> On 16/09/2016 13:36 PM, Andreas Schulze wrote:
> > Hello,
> > 
> > I like to publish a PKIX-TA which mean I publisch a whole certificate, the whole blob...

In almost all cases this is a bad idea, a SHA2-256 digest is quite secure enough,
and is much less bloated.

> > I found https://www.huque.com/bin/gen_tlsa but some commandline voodoo using openssl or ldns-dane would be cool.
> > Any suggestions?
> 
> Viktor has posted his "tlsagen" script here on the list, that works fine
> (I've used it to generate a 0 0 0 for testing purposes last week).

Attaching "tlsagen" and "chaingen".  Note, the latter does not verify
the integrity of the chain, garbage-in = garbage-out.

-- 
	Viktor.
-------------- next part --------------
#! /usr/bin/env bash
# Bash needed for PIPESTATUS array

extract() {
  case "$4" in
  0) openssl x509 -in "$1" -outform DER;;
  1) openssl x509 -in "$1" -noout -pubkey | openssl pkey -pubin -outform DER;;
  esac
}
digest() {
  case "$5" in
  0) cat;;
  1) openssl dgst -sha256 -binary;;
  2) openssl dgst -sha512 -binary;;
  esac
}
encode() {
  local cert=$1; shift
  local hostport=$1; shift
  local u=$1; shift
  local s=$1; shift
  local m=$1; shift
  local host=$hostport
  local port=25

  OIFS="$IFS"; IFS=":"; set -- $hostport; IFS="$OIFS"
  if [ $# -eq 2 ]; then host=$1; port=$2; fi

  printf "_%d._tcp.%s. IN TLSA %d %d %d %s\n" \
    "$port" "$host" "$u" "$s" "$m" \
     "$(od -vAn -tx1 | tr -d ' \012')"
}

error() { echo "$1" 1>&2; exit 1; }
usage() { error "Usage: $0 cert.pem host[:port] usage selector mtype"; }
if [ $# -ne 5 ]; then usage; fi

case "$(echo $3 | tr '[A-Z]' '[a-z]')" in
0|pkix-[ct]a)	usage=0;;
1|pkix-ee)	usage=1;;
2|dane-[ct]a)	usage=2;;
3|dane-ee)	usage=3;;
*)		error "Invalid certificate usage: $3";;
esac

case "$(echo $4 | tr '[A-Z]' '[a-z]')" in
0|cert)		selector=0;;
1|spki|pkey)	selector=1;;
*) 		error "Invalid selector: $4";;
esac

case "$(echo $5 | tr '[A-Z]' '[a-z]')" in
0|full) 			mtype=0;;
1|sha2-256|sha256|sha-256) 	mtype=1;;
2|sha2-512|sha512|sha-512) 	mtype=2;;
*)				error "Invalid matching type: $5";;
esac

set -- "$1" "$2" "$usage" "$selector" "$mtype"
rr=$(
    extract "$@" | digest "$@" | encode "$@"
    exit $(( ${PIPESTATUS[0]} | ${PIPESTATUS[1]} | ${PIPESTATUS[2]} ))
)
status=$?

if [ $status -ne 0 ]; then
    exit $status
fi
echo "$rr"
-------------- next part --------------
#! /usr/bin/env bash
# Bash needed for PIPESTATUS array

extract() {
  case "$4" in
  0) openssl x509 -in "$1" -outform DER;;
  1) openssl x509 -in "$1" -noout -pubkey | openssl pkey -pubin -outform DER;;
  esac
}
digest() {
  case "$5" in
  0) cat;;
  1) openssl dgst -sha256 -binary;;
  2) openssl dgst -sha512 -binary;;
  esac
}
encode() {
  local cert=$1; shift
  local hostport=$1; shift
  local u=$1; shift
  local s=$1; shift
  local m=$1; shift
  local host=$hostport
  local port=25

  OIFS="$IFS"; IFS=":"; set -- $hostport; IFS="$OIFS"
  if [ $# -eq 2 ]; then host=$1; port=$2; fi

  printf "_%d._tcp.%s. IN TLSA %d %d %d %s\n" \
    "$port" "$host" "$u" "$s" "$m" \
     "$(od -vAn -tx1 | tr -d ' \012')"
}

genrr() {
    rr=$(
	extract "$@" | digest "$@" | encode "$@"
	exit $(( ${PIPESTATUS[0]} | ${PIPESTATUS[1]} | ${PIPESTATUS[2]} ))
    )
    status=$?; if [ $status -ne 0 ]; then exit $status; fi
    echo "$rr"
}

error() { echo "$1" 1>&2; exit 1; }
usage() { error "Usage: $0 chain.pem host[:port]"; }
if [ $# -ne 2 ]; then usage; fi

# Validate and normalize the chain
#
certfile=$1; shift
chain="$(
    openssl crl2pkcs7 -nocrl -certfile "$certfile" |
	openssl pkcs7 -print_certs
    exit $(( ${PIPESTATUS[0]} | ${PIPESTATUS[1]} ))
)"
status=$?; if [ $status -ne 0 ]; then exit $status; fi

hostport=$1; shift
usage=3
cert=
printf "%s\n\n" "$chain" |
while read line
do
    if [[ -z "$cert" && ! "$line" =~ ^-----BEGIN ]]; then
	continue
    fi
    cert=$(printf "%s\n%s" "$cert" "$line")
    if [ -z "$line" -a ! -z "$cert" ]; then
	echo "$cert" |
	    openssl x509 -noout -subject -issuer -dates |
	    sed -e 's/^/;; /'
	echo ";;"
	genrr <(echo "$cert") "$hostport" $usage 0 1
	genrr <(echo "$cert") "$hostport" $usage 1 1
	genrr <(echo "$cert") "$hostport" $usage 0 2
	genrr <(echo "$cert") "$hostport" $usage 1 2
	echo
	cert=""
	usage=2
    fi
done


More information about the dane-users mailing list