Check a DANE TLS Service

This application checks a DANE TLS Service. It connects to the specified TLS service and then attempts to authenticate its TLS server certificate according to its corresponding DANE TLSA records in the DNS.

Port: 5223
Domain name: xmpp.eco.br
Name Check for DANE-EE: on

DANE Authentication Successful.


Checking Transcript: 

Host: xmpp.eco.br Port: 5223
SNI: xmpp.eco.br
DNS TLSA RRset:
  qname: _5223._tcp.xmpp.eco.br.
  3 1 1 7f6443180ba81570d8be42016c3a9a06371939306b0c95bc7c0b6dd4b8d3dc9c
IP Addresses found:
  2a02:c206:2213:944::1
  37.60.248.136

## Checking xmpp.eco.br 2a02:c206:2213:944::1 port 5223
DANE TLSA 3 1 1 [7f644318..]: OK matched EE certificate
## Peer Certificate Chain:
   0 CN=xmpp.eco.br
     CN=E5,O=Let's Encrypt,C=US
   1 CN=E5,O=Let's Encrypt,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
## PKIX Certificate Chain 0:
   0 CN=xmpp.eco.br
     CN=E5,O=Let's Encrypt,C=US
   1 CN=E5,O=Let's Encrypt,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
   2 CN=ISRG Root X1,O=Internet Security Research Group,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
## DANE Certificate Chain 0:
   0 CN=xmpp.eco.br
     CN=E5,O=Let's Encrypt,C=US
   1 CN=E5,O=Let's Encrypt,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
## TLS Connection Info:
   TLS version: 1.3
   CipherSuite: TLS_AES_256_GCM_SHA384
## End-Entity Certificate Info:
   X509 version: 3
   Serial#: 4933cb8be13cedc8f85a23386dda5e8844c
   Subject: CN=xmpp.eco.br
   Issuer:  CN=E5,O=Let's Encrypt,C=US
   SAN dNSName: xmpp.eco.br
   Signature Algorithm: ECDSA-SHA384
   PublicKey Algorithm: ECDSA 512-Bits
   Inception:  2024-10-12 13:29:51 +0000 UTC
   Expiration: 2025-01-10 13:29:50 +0000 UTC
   KU: DigitalSignature
   EKU: ServerAuth ClientAuth
   Is CA?: false
   SKI: 6a05de3f59b960fb3a6db6ace7208e5c19536592
   AKI: 9f2b5fcf3c214f9d04b7ed2b2cc4c6708bd2d70d
   OSCP Servers: [http://e5.o.lencr.org]
   CA Issuer URL: [http://e5.i.lencr.org/]
   CRL Distribution: []
   Policy OIDs: [2.23.140.1.2.1]
Result: DANE OK

## Checking xmpp.eco.br 37.60.248.136 port 5223
DANE TLSA 3 1 1 [7f644318..]: OK matched EE certificate
## Peer Certificate Chain:
   0 CN=xmpp.eco.br
     CN=E5,O=Let's Encrypt,C=US
   1 CN=E5,O=Let's Encrypt,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
## PKIX Certificate Chain 0:
   0 CN=xmpp.eco.br
     CN=E5,O=Let's Encrypt,C=US
   1 CN=E5,O=Let's Encrypt,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
   2 CN=ISRG Root X1,O=Internet Security Research Group,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
## DANE Certificate Chain 0:
   0 CN=xmpp.eco.br
     CN=E5,O=Let's Encrypt,C=US
   1 CN=E5,O=Let's Encrypt,C=US
     CN=ISRG Root X1,O=Internet Security Research Group,C=US
## TLS Connection Info:
   TLS version: 1.3
   CipherSuite: TLS_AES_256_GCM_SHA384
## End-Entity Certificate Info:
   X509 version: 3
   Serial#: 4933cb8be13cedc8f85a23386dda5e8844c
   Subject: CN=xmpp.eco.br
   Issuer:  CN=E5,O=Let's Encrypt,C=US
   SAN dNSName: xmpp.eco.br
   Signature Algorithm: ECDSA-SHA384
   PublicKey Algorithm: ECDSA 512-Bits
   Inception:  2024-10-12 13:29:51 +0000 UTC
   Expiration: 2025-01-10 13:29:50 +0000 UTC
   KU: DigitalSignature
   EKU: ServerAuth ClientAuth
   Is CA?: false
   SKI: 6a05de3f59b960fb3a6db6ace7208e5c19536592
   AKI: 9f2b5fcf3c214f9d04b7ed2b2cc4c6708bd2d70d
   OSCP Servers: [http://e5.o.lencr.org]
   CA Issuer URL: [http://e5.i.lencr.org/]
   CRL Distribution: []
   Policy OIDs: [2.23.140.1.2.1]
Result: DANE OK

[0] Authentication succeeded for all (2) peers.



Check another DANE service?

Other DANE Tools

References