Context: I'm setting up a .bit domain on the Namecoin blockchain, and I want to use TLS with it.

According to my understanding, DANE is a protocol whereby valid TLS keys for a domain are discovered through some newly-defined DNS queries, instead of or in addition to through CA-signed certificates. While a CA goes through some hoops to verify that you are the owner of a domain (such as sending an email to the address in the SOA section, or asking you to add a secret TXT record), DANE directly defines valid TLS keys in the DNS server itself, so as long as you have a secure connection with the authoritative DNS server for a domain, it's just as secure as using a certificate.

Namecoin enables TLS on .bit domains via the DANE protocol. Therefore, I am looking for browser add-ons for Firefox and/or Chromium (or other browsers) that will query the DNS server for DANE protocol records (TLSA, if I am not mistaken), and use those to validate TLS keys.

Firefox has this addon but A) it's not compatible with firefox 57 and B) I am not clear on whether the plugin uses DANE instead of checking that the cert is signed by a CA or in addition to doing that.

I went ahead and installed DNSSEC Validator and TLSA Validator for Chrome but they are giving me these "The DNSSEC validating core could not be initialised" errors that I unfortunately do not have time to google tonight. Those extensions might work.

A quick google search did not reveal any other (compatible) plugins for Firefox or Chrome, so I'm just wondering if there are any I may not have seen, or if there are any that are currently being written, or if either of those two Chrome extensions has the ability to verify TLS keys through DANE instead of through CA certs.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.