24. January 2018
TLSA Records are a new feature which adds an additional layer of security for checking the validity of server certificates. The TLSA record is placed in DNS, which can be queried by a client to verify the SHA hash the domain holds against the certificate a server has presented the client. If the Key matches DNS has "agreed" that the certificate does indeed match. This security protects against the wrongful issuing of certificates by CA's and also the theft of certificates.
#Add a TLSA DNS Record
Add-DNSServerResourceRecord -CertificateAssociationData 2a8f2d8af0eb123898f74c866ac3fa669054e23c17bc7a95bd0234192dc635d0 -CertificateUsage DomainIssuedCertificate -MatchType Sha256Hash -Selector SubjectPublicKeyInfo -TLSA -ZoneName www.techshizz.com -Name _443._tcp.www
This record combines with DNSSEC provides a robust security system to protect agains man in the middle attacks. Due to the need to DNSSEC, and a provider who offers TLSA, it's going to be a premium service if used on the internet. It does come with server 2016 for internal usage on the corporate infrastructure.