Managing Mission - Critical Domains and DNS

CERT

The CERT RR type allows you to publish public key certificates (and their revocation lists) over DNS.

Here is the CERT RR Syntax:

<OWNER_NAME> IN CERT <TYPE> <KEY-TAG> <ALGORITHM> <cert-crl>

The type field is either an unsigned decimal (column 1) or a mnemonic (column 2) that corresponds to the following values:

Table 7-1. CERT RR Type Field Values (via RFC 4398)

The key-tag field is a 16-bit value derived from the key in the certificate/crl.

The algorithm field uses the same encryption algorithm values/mnemonics as used in DNSSEC.

The certificate or crl itself is base64-encoded and can be broken up by whitespaces or span multiple lines ...