[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNb1osPkbFlAJrSdCZbE1SASixs_6PLmBeoQWCJ_t2bU":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"56d3ebcb-170a-4f96-9134-ae85fb65542b","article","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","浏览器如何判断网站提供的 TLS 证书可信？常见答案是依赖证书颁发机构（CA）体系：证书链最终通向客户端信任的根证书。DANE（DNS-based Authentication of Named Entities）提供另一种把服务证书或公钥信息与域名关联的机制，使用 DNS 中的 TLSA 记录发布相关约束，并依赖 DNSSEC 为这些记录提供来源验证。\n\nTLSA 记录可以表达多种匹配方式，例如绑定完整证书、证书中的公钥，或与证书链验证结合的额外条件。客户端查询域名对应的 TLSA 记录后，如果 DNSSEC 验证成功，就能把 DNS 中得到的认证信息用于检查 TLS 连接。它的关键不是“DNS 里写了个证书哈希就可信”，而是从 DNSSEC 建立可验证的记录链，再按具体 TLSA 用法判断连接是否符合预期。\n\n这对服务运维有潜在好处：组织可以利用自己的 DNS 区域发布证书约束，在证书更新时通过 DNS 调整服务端信息，减少对某些单点误发证书风险的依赖。但这也把运维责任扩展到 DNSSEC 密钥管理、TLSA 记录更新和客户端支持。记录过期或更新顺序错误，可能让合法用户无法连接；DNSSEC 部署本身也必须正确维护。\n\nDANE 并不意味着“所有网站都可以抛弃 CA”。使用场景和验证模式各有要求：有的用法仍结合现有 PKIX 证书验证，有的适用于特定服务或自签名证书配置。客户端是否查询并验证 TLSA、DNSSEC 是否有效、服务是否按预期发布记录，都会影响最终安全结论。不能仅凭服务器有一条 TLSA 记录，就断言浏览器已经采用 DANE。\n\n打个比方，CA 体系像由多个公证处共同组成的证书链；DANE 则让域名所有者通过受 DNSSEC 保护的公告栏，发布“我的服务应当使用这类证书\u002F密钥”的声明。公告栏必须能证明内容没有被篡改，访问者也必须真的去核对公告。任何一个环节缺失，声明都不能发挥应有作用。\n\nDANE\u002FTLSA 的价值在于把域名管理与 TLS 身份验证联系起来，为特定环境提供额外的信任路径或约束。它是否适合一个网站，取决于客户端生态、服务类型、DNSSEC 运维成熟度以及故障恢复能力。理解它时要同时记住三件事：TLSA 给出约束，DNSSEC 保护 DNS 数据可信，客户端负责执行验证。\n\n来源：[IETF RFC 7671：The DNS-Based Authentication of Named Entities (DANE) Protocol](https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc7671\u002F)","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"Internet Engineering Task Force","https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc7671\u002F","published",false,42,0,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:55.563Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":61,"createdAt":70},"1cc0b372-1c09-4718-b058-75e8eccae8df","QUIC DATAGRAM：有些实时数据为什么不值得重传？","quic-datagram-unreliable-transport","QUIC DATAGRAM 扩展让应用在加密 QUIC 连接中传递不保证重传、也不保证有序的短消息，适合过期即无用的实时数据。它仍受拥塞控制，也需要双方协商支持；本文用语音与游戏状态说明取舍。","\u002Fuploads\u002F2026-10-17\u002Fd0072eed-769d-4cdb-9bd7-7e2eedf7bbda.jpg",43,"2026-10-17T03:08:42.958Z"]