BYTETOOLS

TLSA Record Generator

Paste a certificate and get its DANE TLSA record: pick usage, selector and matching type, and the SHA-256 or SHA-512 hash is computed in your browser.

…or drop a .pem, .crt, .cer or .der fileRead locally — never uploaded
—
Certificate loaded
SPKI
Data hashed
SHA-256
Digest
_443._tcp.example.com
Record owner

TLSA record

Paste a certificate above — or load the sample — and the TLSA record for your chosen usage, selector and matching type appears here.

What the three numbers mean

Usage
0 and 1 add DANE on top of ordinary public-CA validation; 2 and 3 replace it. HTTPS clients rarely implement DANE at all, but SMTP servers do — and RFC 7672 permits only 2 and 3 for mail.
Selector
0 covers the entire DER certificate. 1 covers only the SubjectPublicKeyInfo, so reissuing the same key with new dates keeps the record valid.
Matching
0 publishes the raw data, 1 a SHA-256 digest and 2 a SHA-512 digest. Everybody uses 1.

Publish the new record and wait for the old TTL to expire before you swap the certificate, then remove the old record afterwards. Rolling the two at once is the usual way DANE breaks a mail server.

What is the TLSA Record Generator?

DANE publishes a fingerprint of your TLS certificate in DNS, so a client can pin the exact certificate or key instead of trusting any public CA.

  • Decodes PEM, base64, hex and raw DER, including dropped .der and .cer files
  • Extracts the SubjectPublicKeyInfo substructure for selector 1, verified against a reference decoder
  • SHA-256 and SHA-512 digests computed with the browser's Web Crypto
  • Configurable port, protocol and hostname build the _port._proto owner name
  • Warns about selector 0 renewal breakage and usages that RFC 7672 forbids for SMTP
  • Copy the bare value or the whole zone-file line — everything stays on your device

How to use the TLSA Record Generator

  1. 1

    Paste your certificate PEM, or drop a .pem, .crt, .cer or .der file onto the drop zone.

  2. 2

    Click “Read certificate” — or load the sample — and the DER length appears in the summary tiles.

  3. 3

    Choose the certificate usage, selector and matching type. For SMTP that means usage 3, selector 1, matching 1.

  4. 4

    Set the hostname, port and protocol so the record gets the right _443._tcp style owner name.

  5. 5

    Copy the value for your DNS panel, or the full line for a zone file, and publish it in a DNSSEC-signed zone.

About the TLSA Record Generator

DANE publishes a fingerprint of your TLS certificate in DNS, so a client can pin the exact certificate or key instead of trusting any public CA. This generator takes a PEM certificate — or a bare public key — decodes the DER, extracts the SubjectPublicKeyInfo when you choose selector 1, hashes it with Web Crypto, and prints the finished TLSA record.

All three fields are yours to set: certificate usage 0 to 3, selector 0 for the full certificate or 1 for the public key, and matching type 0, 1 or 2 for raw data, SHA-256 or SHA-512. The owner name is assembled from the port, protocol and hostname you enter, and the tool warns when a combination is wrong for SMTP or will break on your next renewal.

The certificate is decoded and hashed entirely in your browser using the standard Web Crypto digest, so nothing is uploaded and no host is contacted — you can paste a certificate for a server that is not reachable yet, or work offline entirely. Two things are worth remembering before you publish: a TLSA record is only honoured in a DNSSEC-signed zone, and the old record has to stay live until every resolver has seen the new one.

Frequently asked questions

What is a TLSA record?

A TLSA record is the DNS half of DANE. It carries a fingerprint of the certificate or public key a service will present, so a client can verify the connection against DNS rather than, or in addition to, the public CA system. It only works in a DNSSEC-signed zone.

Which TLSA usage, selector and matching type should I pick?

For SMTP, 3 1 1 is the standard choice: DANE-EE with the SubjectPublicKeyInfo hashed with SHA-256. RFC 7672 permits only usages 2 and 3 for mail. Selector 1 matters because it survives a certificate renewal as long as you keep the same key.

Why does selector 0 break when I renew my certificate?

Selector 0 hashes the entire certificate, which changes on every reissue — new dates and a new serial produce a different hash even with the same key. Selector 1 hashes only the public key, so renewing with the existing key leaves the record valid.

How do I roll a certificate without breaking DANE?

Publish the new TLSA record alongside the old one, wait for at least the old record's TTL so every resolver has both, then swap the certificate, and only afterwards remove the old record. Swapping the certificate and the record at the same time is the usual way DANE breaks delivery.

Does DANE work without DNSSEC?

No. The whole security argument rests on the TLSA record being signed, so a validating resolver knows it was not tampered with. In an unsigned zone the record is simply ignored, which is worse than useless because it looks configured.

Is my certificate uploaded when I generate the record?

No. The PEM is decoded and hashed inside your browser with the built-in Web Crypto digest. A certificate is public information anyway, but nothing you paste or drop is transmitted.

Related tools