--- name: "ldns_dane_cert2rdf" section: "3" platform: "linux" package: "ldns" version: "1.9.2-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/ldns_dane_cert2rdf" --- # ldns\_dane\_cert2rdf(3) TLSA RR creation functions ## NAME ldns\_dane\_create\_tlsa\_rr, ldns\_dane\_create\_tlsa\_owner, ldns\_dane\_cert2rdf, ldns\_dane\_select\_certificate - TLSA RR creation functions ## SYNOPSIS \#include \\ \#include \\ \#include \ ldns\_status ldns\_dane\_create\_tlsa\_rr(ldns\_rr\*\* tlsa, ldns\_tlsa\_certificate\_usage certificate\_usage, ldns\_tlsa\_selector selector, ldns\_tlsa\_matching\_type matching\_type, X509\* cert); ldns\_status ldns\_dane\_create\_tlsa\_owner(ldns\_rdf\*\* tlsa\_owner, const ldns\_rdf\* name, uint16\_t port, ldns\_dane\_transport transport); ldns\_status ldns\_dane\_cert2rdf(ldns\_rdf\*\* rdf, X509\* cert, ldns\_tlsa\_selector selector, ldns\_tlsa\_matching\_type matching\_type); ldns\_status ldns\_dane\_select\_certificate(X509\*\* selected\_cert, X509\* cert, STACK\_OF(X509)\* extra\_certs, X509\_STORE\* pkix\_validation\_store, ldns\_tlsa\_certificate\_usage cert\_usage, int index); ## DESCRIPTION *ldns\_dane\_create\_tlsa\_rr*() Creates a TLSA resource record from the certificate. No PKIX validation is performed! The given certificate is used as data regardless the value of certificate\_usage. .br **tlsa**: The created TLSA resource record. .br **certificate\_usage**: The value for the Certificate Usage field .br **selector**: The value for the Selector field .br **matching\_type**: The value for the Matching Type field .br **cert**: The certificate which data will be represented .br Returns LDNS\_STATUS\_OK on success or an error code otherwise. *ldns\_dane\_create\_tlsa\_owner*() Creates a dname consisting of the given name, prefixed by the service port and type of transport: \_\port\.\_\transport\.\name\. .br **tlsa\_owner**: The created dname. .br **name**: The dname that should be prefixed. .br **port**: The service port number for which the name should be created. .br **transport**: The transport for which the name should be created. .br Returns LDNS\_STATUS\_OK on success or an error code otherwise. *ldns\_dane\_cert2rdf*() Creates a LDNS\_RDF\_TYPE\_HEX type rdf based on the binary data chosen by the selector and encoded using matching\_type. .br **rdf**: The created created rdf of type LDNS\_RDF\_TYPE\_HEX. .br **cert**: The certificate from which the data is selected .br **selector**: The full certificate or the public key .br **matching\_type**: The full data or the SHA256 or SHA512 hash of the selected data .br Returns LDNS\_STATUS\_OK on success or an error code otherwise. *ldns\_dane\_select\_certificate*() Selects the certificate from cert, extra\_certs or the pkix\_validation\_store based on the value of cert\_usage and index. .br **selected\_cert**: The selected cert. .br **cert**: The certificate to validate (or not) .br **extra\_certs**: Intermediate certificates that might be necessary during validation. May be NULL, except when the certificate usage is "Trust Anchor Assertion" because the trust anchor has to be provided.(otherwise choose a "Domain issued certificate!" .br **pkix\_validation\_store**: Used when the certificate usage is "CA constraint" or "Service Certificate Constraint" to validate the certificate and, in case of "CA constraint", select the CA. When pkix\_validation\_store is NULL, validation is explicitly turned off and the behaviour is then the same as for "Trust anchor assertion" and "Domain issued certificate" respectively. .br **cert\_usage**: Which certificate to use and how to validate. .br **index**: Used to select the trust anchor when certificate usage is "Trust Anchor Assertion". 0 is the last certificate in the validation chain. 1 the one but last, etc. When index is -1, the last certificate is used that MUST be self-signed. This can help to make sure that the intended (self signed) trust anchor is actually present in extra\_certs (which is a DANE requirement). .br Returns LDNS\_STATUS\_OK on success or an error code otherwise. ## AUTHOR The ldns team at NLnet Labs. ## REPORTING BUGS Please report bugs to dns-team@nlnetlabs.nl or on GitHub at https://github.com/NLnetLabs/ldns/issues ## COPYRIGHT Copyright (c) 2004 - 2006 NLnet Labs. Licensed under the BSD License. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. ## SEE ALSO *ldns\_dane\_verify*, *ldns\_dane\_verify\_rr*. And **perldoc Net::DNS**, **RFC1034**, **RFC1035**, **RFC4033**, **RFC4034** and **RFC4035**. ## REMARKS This manpage was automatically generated from the ldns source code.