跳到主要内容

2. The TLSA Resource Record (TLSA 资源记录)

TLSA DNS resource record 用于把 TLS server certificate 或 public key 与该 record 所在 domain name 关联, 形成 TLSA certificate association.

2.1 TLSA RDATA Wire Format (TLSA RDATA 线格式)​

TLSA RR 的 RDATA 包含 1-octet certificate usage field, 1-octet selector field, 1-octet matching type field, 以及 certificate association data field.

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|  Cert. Usage  |   Selector    | Matching Type |               /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+               /
/                 Certificate Association Data                  /
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

2.1.1 Certificate Usage (证书用途)​

  • 0 CA constraint: TLSA 指定的 CA certificate 或 public key MUST 出现在 server end-entity certificate 的有效 PKIX certification path 中.
  • 1 Service certificate constraint: TLSA 指定的 end-entity certificate 或 public key MUST 与 server 提供的 end-entity certificate 匹配, 且 certificate MUST 通过 PKIX validation.
  • 2 Trust anchor assertion: TLSA 指定的 certificate 或 public key MUST 作为该 certification path validation 的 trust anchor.
  • 3 Domain-issued certificate: TLSA 指定的 certificate 或 public key MUST 与 server end-entity certificate 匹配, 但不要求 PKIX validation.

这些 usage 只适用于 DER encoded PKIX certificate.

2.1.2 Selector (选择器)​

  • 0 Full certificate: 匹配完整 Certificate binary structure.
  • 1 SubjectPublicKeyInfo: 匹配 DER-encoded SubjectPublicKeyInfo.

2.1.3 Matching Type (匹配类型)​

  • 0 Exact match.
  • 1 SHA-256 hash.
  • 2 SHA-512 hash.

2.1.4 Certificate Association Data (证书关联数据)​

该字段包含要匹配的 raw data 或 raw data hash. Raw data 由 selector 决定, hash algorithm 由 matching type 决定.

2.2 Presentation Format (表示格式)​

Presentation format 中, certificate usage, selector 和 matching type 均表示为 8-bit unsigned integer. Certificate association data 表示为 hexadecimal character string, 可按 DNS master file 规则包含 whitespace.

2.3 Examples (示例)​

_443._tcp.www.example.com. IN TLSA (
   0 0 1 d2abde240d7cd3ee6b4b28c54df034b9
         7983a1d16e8a410e4561cb106618e971 )
_443._tcp.www.example.com. IN TLSA (
   3 0 0 30820307308201efa003020102020... )
最后于 更新