Open jult opened 1 year ago
I agree, great tool! And i also vote for rollover-support.
Or maybe pause the script, until the TTL of the previous TLSA record is expired, then delete the previous TLSA record (in case the TTL is just a few minutes).
For that to work you need a way to see what the old expiring records are and then delete them indeed, as they expire? Cloudflare doesn't just replace them, it adds new ones. What a silly invention, this DANE TLSA thing, it's horribly designed. Just think of the issues arising from people wanting to simply update their TLSA records. https://github.com/internetstandards/toolbox-wiki/blob/main/DANE-for-SMTP-how-to.md#tips--tricks-and-notices-for-implementation
Great tool! Happy user. Would be even greater if you'd add a rollover-scheme to the cloudflare.
I think you could pull it off using option 2, using current root or intermediate certs. If I find the time I will look at the script and add this.. shouldn't be too hard.