Add support for DANE / TLSA #435

New Issue

2026-10-05T04:20:30+02:00

adam commented

2026-10-05 04:20:30 +02:00

ZNC should try to authenticate certificates using DANE when connecting to TLS servers.

DANE is a protocol which replaces or reinforces the X.509 validation of certificates used by SSL/TLS, which is usually done by checking the signature added by a certification authority. With DANE, the certificate fingerprint can also be checked with a DNS query, hopefully authenticated by DNSSEC. It is very useful with self-signed certificates, as it allows the server administrator to explicitly tell the client which certificate it should receive and to ignore the signature validation.

References:

RFC 6698
irssi's announcement with a more detailed description and motivation
irssi's implementation which uses the dnsval library (libval-{bin,dev} on Debian Jessie)

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/7182050-add-support-for-dane-tlsa?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

ZNC should try to authenticate certificates using DANE when connecting to TLS servers. [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities) is a protocol which replaces or reinforces the X.509 validation of certificates used by SSL/TLS, which is usually done by checking the signature added by a certification authority. With DANE, the certificate fingerprint can also be checked with a DNS query, hopefully authenticated by DNSSEC. It is very useful with self-signed certificates, as it allows the server administrator to explicitly tell the client which certificate it should receive and to ignore the signature validation. References: - [RFC 6698](http://tools.ietf.org/html/rfc6698) - [irssi's announcement](http://ahf.me/articles/2013/09/14/enhancing-ssl-security-for-irc-dane-support/) with a more detailed description and motivation - [irssi's implementation](https://github.com/irssi/irssi/blob/8bd575df2ec0d4a17b6f59116d555b64f5bb1312/src/core/network-openssl.c#L209-L241) which uses the [dnsval library](http://dnssec-tools.org/) (libval-{bin,dev} on Debian Jessie) ## <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/7182050-add-support-for-dane-tlsa?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:20:31 +02:00

There also appears to be pull request for WeeChat https://github.com/weechat/weechat/pull/121.
UPDATE: https://weechat.org/dev/roadmap/ lists it for Version 1.2 (≈ Mar 1, 2015).

There also appears to be pull request for WeeChat https://github.com/weechat/weechat/pull/121. UPDATE: https://weechat.org/dev/roadmap/ lists it for Version 1.2 (≈ Mar 1, 2015).

adam commented

2026-10-05 04:20:31 +02:00

I'll happily look into this, if there's an interest. I did the Irssi support for DANE.

I'll happily look into this, if there's an interest. I did the Irssi support for DANE.

adam commented

2026-10-05 04:20:32 +02:00

I think that there is interest as more clients and networks start supporting this. There was complaining on #znc about certificates and most of networks have invalid certificates.

I am not sure if networks are going to start supporting this, but if clients don't start supporting it, networks won't do it either and there is a little loop here.

I asked ChatSpike to post their fingerprints which they are willing to do after new year, but DANE seemed too complex to them as it's not supported by clients.

From what I understood, currently only one server supports DANE.

I think that there is interest as more clients and networks start supporting this. There was complaining on #znc about certificates and most of networks have invalid certificates. I am not sure if networks are going to start supporting this, but if clients don't start supporting it, networks won't do it either and there is a little loop here. I asked ChatSpike to post their fingerprints which they are willing to do after new year, but DANE seemed too complex to them as it's not supported by clients. From what I understood, currently only one server supports DANE.

adam commented

2026-10-05 04:20:33 +02:00

Does DANE provide any benefit over letsencrypt/startssl/cacert which are free?

Does DANE provide any benefit over letsencrypt/startssl/cacert which are free?

adam commented

2026-10-05 04:20:33 +02:00

The main advantage of DANE is that it does not rely on the trust store. The TLSA record indicates which certificate or which exact CA is valid for the server. With the classic validation, any CA (even a rogue or compromised one) can sign a valid certificate for your domain, as long as the CA is in trust store.

Regarding the implementation, OpenSSL has recently released its v1.1.0-beta3, with built-in DANE support. So I would use that to implement DANE.

The main advantage of DANE is that it does not rely on the trust store. The TLSA record indicates which certificate or which exact CA is valid for the server. With the classic validation, any CA (even a rogue or compromised one) can sign a valid certificate for your domain, as long as the CA is in trust store. Regarding the implementation, OpenSSL has recently released its v1.1.0-beta3, with [built-in DANE support](https://www.openssl.org/docs/manmaster/ssl/SSL_dane_enable.html). So I would use that to implement DANE.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#435