Skip to content
Tech Shizz Logo

An Engineers Blog

  • TechShizz
  • blog

DNS | TLSA Records to ensure the validity of SSL certificates

Posted on February 23, 2021 By rich No Comments on DNS | TLSA Records to ensure the validity of SSL certificates

TLSA Records are a new feature which adds an additional layer of security for checking the validity of server certificates. The TLSA record is placed in DNS, which can be queried by a client to verify the SHA hash the domain holds against the certificate a server has presented the client. If the Key matches DNS has “agreed” that the certificate does indeed match. This security protects against the wrongful issuing of certificates by CA’s and also the theft of certificates. 

#Add a TLSA DNS Record
Add-DNSServerResourceRecord -CertificateAssociationData 2a8f2d8af0eb123898f74c866ac3fa669054e23c17bc7a95bd0234192dc635d0 -CertificateUsage DomainIssuedCertificate -MatchType Sha256Hash -Selector SubjectPublicKeyInfo -TLSA -ZoneName www.techshizz.com -Name _443._tcp.www

This record combines with DNSSEC provides a robust security system to protect agains man in the middle attacks. Due to the need to DNSSEC, and a provider who offers TLSA, it’s going to be a premium service if used on the internet. It does come with server 2016 for internal usage on the corporate infrastructure. 

Post navigation

❮ Previous Post: HTTP Error 503 when Single Sin On redirecting to ADFS Server After Re-Enabling Single Sign On
Next Post: Connecting to and Configuring Nano Servers ❯

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Generic selectors
Exact matches only
Search in title
Search in content
Post Type Selectors

Subscribe to our newsletter!

Recent Posts

  • How to implement a lightning-fast ransomware playbook
  • How to achieve defence in depth in your business
  • How to implement a SecOps team phishing response plan
  • How to block an Office 365 Sign-in correctly
  • Microsoft finally patched serious Exchange 0-day over a month old!

Recent Comments

    Archives

    • November 2022
    • July 2021
    • March 2021
    • February 2021

    Categories

    • Cyber Security
    • Uncategorized

    Meta

    • Log in
    • Entries feed
    • Comments feed
    • WordPress.org

    Copyright © 2023 .

    Theme: Oceanly News Dark by ScriptsTown