"dane" does not seem to return the correct result.

[Shushangw]

Hi,

When I tested the good.dane.huque.com, I found a discrepancy between the results I ran locally and the results I got from the DANE Test site and the results I got from the SIDN test site. After double-checking the TLSA record, I found that SIDN should be correct. There seems to be a problem with the TLSA validation process for the dane project.

[shuque]

Hi, thanks for the report. I just looked into it. There is a bug for DANE-EE mode validation that I need to fix. I unintentionally let the certificate for good.dane.huque.com expire, and with DANE-EE mode, a validator is not supposed to check certificate validity periods at all.

I will fix that bug (probably next weekend when I have free time). But I also intend to re-issue the certificate for good.dane.huque.com.

[shuque]

Ok, I had a bit of time, so I've implemented the bug fix, and https://www.huque.com/danecheck will work fine now.

[Shushangw]

Thank you!