Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.

--- pr:le-dns-dane [2023/12/09 18:24] – angelegt martok
+++ pr:le-dns-dane [2026/10/26 23:11] (aktuell) – new script martok
@@ Zeile 14: / Zeile 14: @@
 Find and download the currently used intermediate from LE's published [[https://letsencrypt.org/certificates/|Chain of Trust]]. Then compute its hash:
-<file bash>
+<file bash url-to-TLSA.sh>
-openssl x509 -in lets-encrypt-x3-cross-signed.pem -noout -pubkey |
+#!/bin/bash
-  openssl rsa -pubin -outform DER | openssl dgst -sha256 -hex |
+if [ -z "$1" ] ; then
+    echo usage: $0 URL-TO-PEM
+    exit 1
+fi
+pkfil=$(mktemp)
+trap "[ -f \"$pkfil\" ] && rm -f \"$pkfil\"" EXIT
+curl "$1" |
+  openssl x509 -inform PEM -noout -pubkey > "$pkfil" || { echo "failed to download" ; exit 1 ; }
+{ openssl rsa -in "$pkfil" -pubin -outform DER || openssl ec -pubin -in "$pkfil" -outform DER ; } |
+  openssl dgst -sha256 -hex |
   awk '{print "le-ca TLSA 2 1 1", $NF}'
+</file>
+<file>
+ ./url-to-TLSA.sh https://letsencrypt.org/certs/gen-y/root-yr-by-x1.pem
+  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                 Dload  Upload   Total   Spent    Left  Speed
+  2126  100  2126    0     0  10849      0 --:--:-- --:--:-- --:--:-- 10902
+writing RSA key
+le-ca TLSA 2 1 1 7e4e8838a8add6295de7ae3b047d3aba3488ab95db0a0aa56d897a00d8618bcf
 </file>