In Plesk, you can harden connections to the server using DANE in the following ways:

• Automatically by using the SSL It! extension.
• Manually by generating a hash of the SSL/TLS certificate’s public key, and then adding a TLSA DNS record.

Each way has its own advantages as well as downsides.

The automatic implementation of DANE using SSL It! is easy and needs just a few clicks. However, you can harden only one connection type with DANE: to the mail server for an individual domain. Additionally, you can use DANE only with Let’s Encrypt certificates. If you want to use DANE with SSL/TLS certificates of other certificate authorities, choose the manual implementation.

The manual implementation of DANE is a multistep procedure, which requires time and effort (even though we provide you with a step-by-step guide below). As for the benefits, you can harden connections not only to the mail server but also other ones secured with SSL/TLS certificates. You can also use DANE with SSL/TLS certificates of any certificate authorities, not limited to Let’s Encrypt only.

Regardless of the way you choose, you will need to make sure your server and/or hosted domains meet certain requirements necessary for using DANE.

(Automatically) Hardening Mail Connections Using DANE

Before you can automatically harden a connection to the mail server using DANE, make sure your server and hosted domains have the following configuration:

• For the Plesk server: - The mail service is enabled. - DKIM is enabled. - Plesk is the primary DNS server.
• For the domain whose connection to the mail server you want to harden using DANE: - The mail service is enabled. - DKIM is enabled. - The MX record exists and it resolves to the IP address of the Plesk server. - DNSSEC is enabled.

If all the conditions above are fulfilled, you can harden a connection to the mail server using DANE with the help of the SSL It! extension.

Hardening a Mail Connection Using DANE via SSL It!

1. 登錄到 Plesk。

2. Go to Websites & Domains, and then locate the required domain.

3. Click SSL/TLS Certificates.

4. Under 「Install a free basic certificate provided by Let’s Encrypt」, click Install.

5. Keep the 「Secure the domain name」 checkbox selected.

6. (Optional) Select other checkboxes depending on subdomains you want to secure.

7. Select the 「Assign the certificate to the mail domain」 and 「DANE support」 checkboxes.

   

8. 點按 免費獲取。

   

9. Wait a while until the created TLSA records necessary for DANE are propagated to the DNS server, and then click Install.

SSL It! has secured your domain with a Let’s Encrypt certificate and also hardened the domain’s connection to the mail server using DANE.

Automatically Renewing Certificates with DANE

SSL It! automatically renews free SSL/TLS certificates from Let’s Encrypt 30 days in advance of their expiration. If a certificate was issued with DANE support, SSL It! will configure it for a new certificate as well.

When a new certificate is ready to be installed on the domain, SSL It! creates a corresponding set of TLSA records and sets a timer for 24 hours (it is the default value). After the timer expires, the next run of the SSL It! 「Keep websites secured」 task installs the new certificate and removes old TLSA records. Depending on the configured settings, Plesk also sends an email notification on the certificate renewal.

If desired, you can change the default 24-hour interval between the creation of TLSA records and the installation of a new certificate by adding lines of the following pattern to the panel.ini file:

[ext-sslit]
dane-confirmation-interval-in-hours = <the number of hours>

例如：

[ext-sslit]
dane-confirmation-interval-in-hours = 12

Disabling DANE Support in SSL It!

By default, DANE support is enabled in SSL It! if the Plesk server and hosted domains meet the configuration criteria necessary for DANE. It means that you and your customers can see and select the 「DANE support」 checkbox under 「Assign the certificate to the mail domain」 when securing a domain with a Let’s Encrypt certificate.

To safeguard your customers, you may want to disable DANE support in SSL It! by hiding the corresponding checkbox. To do so, add the following lines to the panel.ini file:

[ext-sslit]
daneEnabled = false

(Manually) Hardening Server Connections Using DANE

You can harden connections via any application protocol that is already secured using an SSL/TLS certificate via the corresponding combination of transport protocol and port (for example, 「TCP/25」 for SMTP, 「TCP/443」 for HTTPS, and so on).

Hardening connections via a specific application protocol is a two-step process:

• First, you need to generate a hash of the SSL/TLS certificate’s public key. Although you can also use the unhashed public key or the hash of the entire certificate, in this example we will be using a public key hash.
• Then, you need to add a TLSA DNS record specifying a number of necessary parameters, including the hash.

You need to repeat the above steps for every application protocol you want to harden.

In the example below, we provide the steps to harden SMTP connections to the mail server for an individual domain. You can use them as reference to harden other connections, if desired.

前提條件

Before you can harden SMTP connections using DANE for an individual domain, you need to do the following:

• Secure connections to the mail server using an SSL/TLS certificate.
• Enable DNSSEC for the domain.

Securing SMTP Server Connections

Generating the certificate public key hash

1. 登錄到 Plesk。

2. Go to Websites & Domains, and then locate the required domain.

3. Click SSL/TLS Certificates.

4. Locate the certificate securing the mail server (the one marked with 「Secures mail」), and then click the icon to download the certificate as a *.pem file.

5. Place the *.pem file on a Linux machine, and then run the following command (make sure to change the working directory to the one containing the file beforehand, and also to replace 「certificate.pem」 with the actual file name):

   openssl x509 -in certificate.pem -pubkey -noout | openssl rsa -pubin -outform der | sha256sum | awk '{print $1}'
   

The resulting output (for example, 499e42e36d7b04529725a1f8036e0f7cf1030b4e25a3fa1988f2572e1ce70d28) is the SHA-256 hash you will use when creating the TLSA DNS record.

Adding the TLSA DNS record

1. 登錄到 Plesk。
2. Go to Websites & Domains, and then locate the required domain.
3. Go to the Hosting & DNS tab, and then click DNS.
4. 按一下 添加記錄 。
5. Select 「TLSA」 from the 「Record type」 drop-down menu.
6. (Optional) Specify a TTL for the record. If you are not sure about what the optimum TTL may be, leave the 「TTL」 field blank. In this case, the default TTL value will be used.
7. Specify port 「25」. Do not add the underscore character, it will be done automatically.
8. Specify protocol 「tcp」. Do not add the underscore character, it will be done automatically.
9. Enter 「mail」 into the 「Domain name」 field.
10. Select 「3, DANE-EE」 from the 「Usage」 drop-down menu.
11. Select 「1, SPKI」 from the 「Selector」 drop-down menu.
12. Select 「1, SHA-256」 from the 「Matching type」 drop-down menu.
13. Paste the certificate public key hash you generated earlier into the 「Certificate association data」 field.
14. Click OK, and then click Update to apply the changes to the DNS zone.

A TLSA DNS record is added, and the changes to the DNS zone are applied. Once the DNS changes have propagated (this usually takes around 24 hours), DANE will become active for SMTP connections to the domain.