The TLSA DNS resource record (RR) is used to associate a TLS server certificate or public key with the domain name where the record is found, thus forming a ‘TLSA certificate association’. For further details see RFC-6698. Note that you must specify only one view for the attribute ‘views’.
References to record:tlsa are object references. The name part of a TLSA record object reference has the following components:
- Name of the record
- Name of the view
Example: record:tlsa/ZG5zLmhvc3RjkuMC4xLg:9.9.0.1/some.name.com/default
These fields are actual members of the object; thus, they can be requested by using _return_fields, if the fields are readable.
The basic version of the object contains the field(s): name, view.
The following fields are required to create this object:
| Field | Notes |
|---|---|
| certificate_data | |
| certificate_usage | |
| matched_type | |
| name | |
| selector |
Hex dump of either raw data for matching type 0, or the hash of the raw data for matching types 1 and 2.
Type
String.
Create
The field is required on creation.
Search
The field is not available for search.
Specifies the provided association that will be used to match the certificate presented in the TLS handshake. Based on RFC-6698.
Type
Unsigned integer.
Create
The field is required on creation.
Search
The field is not available for search.
Structure containing all cloud API related information for this object.
Type
A/An Cloud Information struct.
Search
The field is not available for search.
Notes
The cloud_info cannot be updated.
cloud_info cannot be written.
Comment for the record; maximum 256 characters.
Type
String.
Values with leading or trailing white space are not valid for this field.
Create
The default value is empty.
Search
The field is available for search via
The record creator. Note that changing creator from or to ‘SYSTEM’ value is not allowed.
Type
String.
Create
The default value is STATIC.
Search
The field is available for search via
Determines if the record is disabled or not. False means that the record is enabled.
Type
Bool.
Create
The default value is False.
Search
The field is not available for search.
The name of the TLSA record in punycode format.
Type
String.
Values with leading or trailing white space are not valid for this field.
Search
The field is not available for search.
Notes
The dns_name cannot be updated.
dns_name cannot be written.
Extensible attributes associated with the object.
For valid values for extensible attributes, see the following information.
Type
Extensible attributes.
This field allows +/- to be specified as part of the field name when updating the object, see the following information.
Create
The default value is empty.
Search
For how to search extensible attributes, see the following information.
The time of the last DNS query in Epoch seconds format.
Type
Timestamp.
Search
The field is not available for search.
Notes
The last_queried cannot be updated.
last_queried cannot be written.
Specifies how the certificate association is presented. Based on RFC-6698.
Type
Unsigned integer.
Create
The field is required on creation.
Search
The field is not available for search.
The TLSA record name in FQDN format. This value can be in unicode format.
Type
String.
Values with leading or trailing white space are not valid for this field.
Create
The field is required on creation.
Search
The field is available for search via
Notes
The name is part of the base object.
Specifies which part of the TLS certificate presented by the server will be matched against the association data. Based on RFC-6698.
Type
Unsigned integer.
Create
The field is required on creation.
Search
The field is not available for search.
The Time to Live (TTL) value for the record. A 32-bit unsigned integer that represents the duration, in seconds, for which the record is valid (cached). Zero indicates that the record should not be cached.
Type
Unsigned integer.
Create
The default value is empty.
Search
The field is not available for search.
Notes
Use flag for: ttl
Type
Bool.
Create
The default value is False.
Search
The field is not available for search.
The name of the DNS view in which the record resides. Example: “external”.
Type
String.
Values with leading or trailing white space are not valid for this field.
Create
The default value is The default DNS view.
Search
The field is available for search via
Notes
The view is part of the base object.
The name of the zone in which the record resides. Example: “zone.com”. If a view is not specified when searching by zone, the default view is used.
Type
String.
Values with leading or trailing white space are not valid for this field.
Search
The field is available for search via
Notes
The zone cannot be updated.
zone cannot be written.
| Field | Type | Req | R/O | Base | Search |
|---|---|---|---|---|---|
| certificate_data | String | Y | N | N | N/A |
| certificate_usage | Unsigned int | Y | N | N | N/A |
| cloud_info | struct | N | Y | N | N/A |
| comment | String | N | N | N | : = ~ |
| creator | String | N | N | N | = |
| disable | Bool | N | N | N | N/A |
| dns_name | String | N | Y | N | N/A |
| extattrs | Extattr | N | N | N | ext |
| last_queried | Timestamp | N | Y | N | N/A |
| matched_type | Unsigned int | Y | N | N | N/A |
| name | String | Y | N | Y | : = ~ |
| selector | Unsigned int | Y | N | N | N/A |
| ttl | Unsigned int | N | N | N | N/A |
| use_ttl | Bool | N | N | N | N/A |
| view | String | N | N | Y | = |
| zone | String | N | Y | N | = |
record:srv : DNS SRV record object.
