The certificate used must match the TLSA record exactly .
Certificate must also pass PKIX certification path validation to a trusted root - CA .
The certificate used must match the TLSA record exactly , and it must also pass PKIX certification path validation to a trusted root - CA .