DNS-Based Authentication of Named Entities (DANE) Parameters
2012-06-28
2026-02-05
TLSA Certificate Usages
RFC Required
0
PKIX-TA
CA constraint
1
PKIX-EE
Service certificate constraint
2
DANE-TA
Trust anchor assertion
3
DANE-EE
Domain-issued certificate
4-254
Unassigned
255
PrivCert
Reserved for Private Use
TLSA Selectors
Specification Required
Viktor Dukhovni, Shumon Huque, Paul Wouters
0
Cert
Full certificate
1
SPKI
SubjectPublicKeyInfo
2-254
Unassigned
255
PrivSel
Reserved for Private Use
TLSA Matching Types
Specification Required
Unassigned
0
Full
No hash used
1
SHA2-256
256 bit hash by SHA2
2
SHA2-512
512 bit hash by SHA2
3-254
Unassigned
255
PrivMatch
Reserved for Private Use