What certificate types are supported by RFC 4398?

RFC 4398 specifies type 1 for PKIX (X.509), type 2 for SPKI, type 3 for PGP, type 4 for IPKIX, and types 253/254 for URI-based references.

Updated: August 2026 • Verified v1.2

DNS CERT Record Generator (RFC 4398 PKIX & PGP)

Internet & NetworkNew

Local Browser Execution: Your input is processed locally in your browser and is not sent to UTL servers.

Was this calculation helpful?

Understanding Your Results

Produces valid RFC 4398 DNS CERT zone record strings, tinydns format, key tag checksums, and hex payload diagnostics.

Practical Guidance & Next Steps

Publishing CERT records allows cryptographic certificate discovery via standard DNS queries without relying on proprietary LDAP or external CA directories.

What is this?

A cryptographic network utility for building standard RFC 4398 DNS CERT resource records to distribute public keys and certificates via DNS.

How does it work?

1. Enter domain name and TTL. 2. Select certificate type (PKIX / X.509, PGP, SPKI, or URI). 3. Input key tag, cryptographic algorithm, and paste base64 certificate payload. 4. Copy BIND9 / Cloudflare zone record syntax.

Why use it?

Prevents syntax and encoding errors in RFC 4398 DNS certificate distribution.

Technical Scope & Calculation Limitations

For large X.509 certificates (> 512 bytes), DNS queries must support EDNS0 or fallback to TCP transport.

Frequently Asked Questions

A CERT record (DNS Type 37) stores cryptographic certificates directly in the Domain Name System, enabling automated public key discovery and validation.

Windows Desktop & Widget Options