Skip to main content

A library for using DANE for public key discovery.

Project description

A library for using DANE TLSA records for certificate discovery.

Documentation Status https://circleci.com/gh/ValiMail/dane-discovery.svg?style=shield Maintainability Test Coverage

Quick Start

Installation

pip install dane-discovery

Load a certificate from DNS and print the PEM representation

from dane_discovery.dane import DANE
dns_name = "dns.name.having.a.tlsa.record"
tlsa_record = DANE.get_first_leaf_certificate(dns_name)
if not tlsa_record:
    raise ValueError("No leaf certificate found for {}.".format(dns_name))

der_cert = DANE.certificate_association_to_der(tlsa_record["certificate_association"])
print(DANE.der_to_pem(der_cert))


Load a DANE identity from DNS and print the request context
-----------------------------------------------------------
from dane_discovery.identity import Identity
dns_name = "dns.name.having.a.tlsa.record"
dane_identity = Identity(dns_name)
print(dane_identity)

Name: abc123.air-quality-sensor._device.example.net
Request context:
  DNSSEC: False
  TLS: False
  TCP: True
Credential index: 0
  certificate usage: DANE-EE
  selector: Full certificate match
  matching type: Exact match against certificate association
  x509 attributes:
    {'extensions': {'BasicConstrints': {'ca': False, 'path_length': None},
                    'KeyUsage': {'content_commitment': True,
                                 'crl_sign': False,
                                 'data_encipherment': False,
                                 'digital_signature': True,
                                 'key_agreement': False,
                                 'key_cert_sign': False,
                                 'key_encipherment': True}},
     'subject': {'commonName': 'abc123.air-quality-sensor._device.example.net',
                 'countryName': 'US',
                 'organizationName': 'Example Networks',
                 'stateOrProvinceName': 'CA'}}

More examples

Changelog

v0.9

Changes

  • Add filtering to certificate retrieval tool. [Ash Wilson]

    Close #39

  • Rename CLI sc8ripts to align with package name. [Ash Wilson]

    Close #38

v0.8 (2021-02-27)

New

  • Add dane_pkix_cd_get_ca_certificates. [Ash Wilson]

    Close #32

  • Add dane_pkix_cd_get_certificates. [Ash Wilson]

    Close #31

  • Add authenticate_pkix_cd script. [Ash Wilson]

    Close #29

  • Add PKIX-CD validation for local certificates. [Ash Wilson]

    Close #28

v0.7 (2021-02-18)

New

  • Add certificate_object to output from Identity.process_tlsa() [Ash Wilson]

    Close #23

  • Add support for EC certificates and keys. [Ash Wilson]

    Close #24

v0.6 (2020-11-10)

New

  • Add support for PKIX-CD. [Ash Wilson]

    Breaking changes! Test thoroughly before updating to this version!

    Close #20

  • Add Identity.get_ca_certificate_for_identity() [Ash Wilson]

    Close #18

  • Add Identity.verify_certificate_signature(). [Ash Wilson]

v0.5 (2020-10-15)

Fix

  • Clean up parsing of TLSA records when DNSSEC is in use. [Ash Wilson]

v0.4 (2020-10-15)

Fix

  • Fix parsing of full DNS response message. [Ash Wilson]

v0.3 (2020-10-15)

New

  • Identity __repr__() indicates request context and x509 extensions. [Ash Wilson]

Changes

  • DANE.get_tlsa_records() returns request context. [Ash Wilson]

v0.2 (2020-08-13)

New

  • Support generating TLSA records for matching type 1, 2. [Ash Wilson]

    Closes #3

v0.1 (2020-08-04)

New

  • Add certificate_association_to_der() and der_to_pem() for formatting certs from TLSA RRs. [Ash Wilson]

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dane_discovery-0.9.tar.gz (14.5 kB view hashes)

Uploaded Source

Built Distribution

dane_discovery-0.9-py3-none-any.whl (14.6 kB view hashes)

Uploaded Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page