= bug description =

When I visit fedorahosted.org with the DANE Patrol extension installed I get an error about an invalid TLSA record.

{{{
Certificate for fedorahosted.org had bad TLSA record: None of nonzero usable TLSA associations matched.
}}}

= bug analysis =
When we look at the TLSA record, we get the following.
{{{
$ dig +short TLSA _443._tcp.fedorahosted.org
3 0 1 8F0F2374F2FDB57EF0DDCC2704A1519BA7757AED34145DC8A83236B5 C16AF0DB
}}}

If we compare it to what ldns-dane suggests:
{{{
ldns-dane create fedorahosted.org 443
_443._tcp.fedorahosted.org. 3600 IN TLSA 3 0 1 aaea4d5ff068b0e12819924046e8e7992f9e2855d5aacc5b4c6e58122feb588a
}}}

Then we see a difference. Most likely the certificate was changed, but the TLSA record has not been updated.

= fix recommendation =
Update the TLSA record.