ldns(3) Library Functions Manual ldns(3)

# [NAME](#NAME)

ldns\_dane\_create\_tlsa\_rr, ldns\_dane\_create\_tlsa\_owner, ldns\_dane\_cert2rdf, ldns\_dane\_select\_certificate - TLSA RR creation functions

# [SYNOPSIS](#SYNOPSIS)

#include <stdint.h>  
#include <stdbool.h>

#include <ldns/ldns.h>

ldns\_status ldns\_dane\_create\_tlsa\_rr(ldns\_rr\** tlsa, ldns\_tlsa\_certificate\_usage certificate\_usage, ldns\_tlsa\_selector selector, ldns\_tlsa\_matching\_type matching\_type, X509* cert);

ldns\_status ldns\_dane\_create\_tlsa\_owner(ldns\_rdf\** tlsa\_owner, const ldns\_rdf* name, uint16\_t port, ldns\_dane\_transport transport);

ldns\_status ldns\_dane\_cert2rdf(ldns\_rdf\** rdf, X509* cert, ldns\_tlsa\_selector selector, ldns\_tlsa\_matching\_type matching\_type);

ldns\_status ldns\_dane\_select\_certificate(X509\** selected\_cert, X509* cert, STACK\_OF(X509)* extra\_certs, X509\_STORE* pkix\_validation\_store, ldns\_tlsa\_certificate\_usage cert\_usage, int index);

# [DESCRIPTION](#DESCRIPTION)

*ldns\_dane\_create\_tlsa\_rr*() Creates a TLSA resource record from the certificate. No PKIX validation is performed! The given certificate is used as data regardless the value of certificate\_usage.

**tlsa**: The created TLSA resource record.  
**certificate\_usage**: The value for the Certificate Usage field  
**selector**: The value for the Selector field  
**matching\_type**: The value for the Matching Type field  
**cert**: The certificate which data will be represented

Returns LDNS\_STATUS\_OK on success or an error code otherwise.

*ldns\_dane\_create\_tlsa\_owner*() Creates a dname consisting of the given name, prefixed by the service port and type of transport: \_<EM>port</EM>.\_<EM>transport</EM>.<EM>name</EM>.

**tlsa\_owner**: The created dname.  
**name**: The dname that should be prefixed.  
**port**: The service port number for which the name should be created.  
**transport**: The transport for which the name should be created.  
Returns LDNS\_STATUS\_OK on success or an error code otherwise.

*ldns\_dane\_cert2rdf*() Creates a LDNS\_RDF\_TYPE\_HEX type rdf based on the binary data chosen by the selector and encoded using matching\_type.

**rdf**: The created created rdf of type LDNS\_RDF\_TYPE\_HEX.  
**cert**: The certificate from which the data is selected  
**selector**: The full certificate or the public key  
**matching\_type**: The full data or the SHA256 or SHA512 hash of the selected data  
Returns LDNS\_STATUS\_OK on success or an error code otherwise.

*ldns\_dane\_select\_certificate*() Selects the certificate from cert, extra\_certs or the pkix\_validation\_store based on the value of cert\_usage and index.

**selected\_cert**: The selected cert.  
**cert**: The certificate to validate (or not)  
**extra\_certs**: Intermediate certificates that might be necessary during validation. May be NULL, except when the certificate usage is "Trust Anchor Assertion" because the trust anchor has to be provided.(otherwise choose a "Domain issued certificate!"  
**pkix\_validation\_store**: Used when the certificate usage is "CA constraint" or "Service Certificate Constraint" to validate the certificate and, in case of "CA constraint", select the CA. When pkix\_validation\_store is NULL, validation is explicitly turned off and the behaviour is then the same as for "Trust anchor assertion" and "Domain issued certificate" respectively.  
**cert\_usage**: Which certificate to use and how to validate.  
**index**: Used to select the trust anchor when certificate usage is "Trust Anchor Assertion". 0 is the last certificate in the validation chain. 1 the one but last, etc. When index is -1, the last certificate is used that MUST be self-signed. This can help to make sure that the intended (self signed) trust anchor is actually present in extra\_certs (which is a DANE requirement).

Returns LDNS\_STATUS\_OK on success or an error code otherwise.

# [AUTHOR](#AUTHOR)

The ldns team at NLnet Labs.

# [REPORTING BUGS](#REPORTING_BUGS)

Please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues

# [COPYRIGHT](#COPYRIGHT)

Copyright (c) 2004 - 2006 NLnet Labs.

Licensed under the BSD License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

# [SEE ALSO](#SEE_ALSO)

*ldns\_dane\_verify*, *ldns\_dane\_verify\_rr*. And **perldoc Net::DNS**, **RFC1034**, **RFC1035**, **RFC4033**, **RFC4034** and **RFC4035**.

# [REMARKS](#REMARKS)

This manpage was automatically generated from the ldns source code.

30 May 2006

---

Document: ldns_dane_select_certificate(3) from ldns 1.9.2-r3 (Chainguard OS)
Source: https://github.com/NLnetLabs/ldns.git