Great Dane – a multi-cert capable bulk downloading DANE-EE TLSA RR generator

About

Great Dane generates DANE-EE TLSA resource records to be published in DNSSEC-enabled DNS zones, from certificates directly downloaded via TLS services.

The software is multi-cert, multi-protocol and multi-homed capable, so it will not just download the first certificate supplied, but will actively download EC as well as RSA and DSA certificates from all IP addresses a hostname is associated with, extract the public keys and generate separate RRs for them.

It can work in bulk by scanning multiple hostnames and/or TCP ports at once. STARTTLS is available for any service supported by OpenSSL.

Examples

$ greatdane mail.example.org 25,110,143,465,587,993,995,4190

$ greatdane "example.org www.example.org example.com www.example.com" 443

$ greatdane mx.example.net "25 2525" smtp

Download

Build the RPM

$ rpmbuild -tb greatdane-<version>.tar.gz

License

Great Dane is free software under the terms of the MIT License.

Known issues

• Great Dane requires all hostnames to be lower case, need to add ${str,,}.
  Resolved in version 0.3.1.
• Currently only one connection per hostname is established, even if the hostname resolves to multiple IP addresses, which could theoretically host different certificates issued to different public keys.
  Resolved in version 0.3. Of course, to scan both IPv4 and IPv6 services, Great Dane needs to be executed on a system with dual-stacked or fully address family-mapped network/Internet access.
• Support for RSASSA-PSS and DSA certificates is currently untested due to a lack of access to services featuring such certificates. Do you operate a service using a RSASSA-PSS or DSA certificate? Please let me know.
• Does not work for TLSv1.3-only services.
  Resolved in version 0.2.

Changes

Version 0.3.3 -> 0.3.4

• Removed inadvertent extra empty/spaces line in RR output introduced by changes in version 0.3.2.

Version 0.3.2 -> 0.3.3

• RPM spec file: Updated runtime dependencies.
• Fixed order of generated RRs not matching order of ports given due to removal of awk.

Version 0.3.1 -> 0.3.2

• RPM spec file: Added runtime dependencies.
• RPM spec file: Source URL with dynamic date.
• Eliminated dependency on awk/gawk.
• RPM spec file: Updated runtime dependencies.

Version 0.3 -> 0.3.1

• Updated description.
• Allow hostnames to contain upper case characters.
• Added README.md.
• Restructured changelog and renamed file to CHANGELOG.

Version 0.2.1 -> 0.3

• Now scanning all IP addresses (IPv4 and IPv6) associated with a hostname for certificates/public keys.
• Fixed typo and description.

Version 0.2 -> 0.2.1

• Optimized output.
• Added progress display.
• Fixed typos.

Version 0.1 -> 0.2

• Now works with services offering TLS v1.3 only.
• Added support for DSA certificates.
• Relicensed (MIT).
• Added RPM specfile allowing to build RPM directly from tarball.
• Added description.
• Fixed typos.

Release history