Update README.md

Author: raforg

README.md

@@ -6,7 +6,7 @@
 
 *Danectl* is a DNSSEC DANE implementation manager. It uses *certbot* to create
 and manage pairs of keys for use with a TLSA 3 1 1 current + next workflow.
-It generates TLSA records for your TLS services for you to publish to the DNS,
+It generates TLSA records for your TLS services for you to publish in the DNS,
 checks that they are correctly published, and performs key rollovers.
 
 *Danectl* can also generate and check SSHFP records for the local *SSH* server.
@@ -19,14 +19,15 @@ checks that they are correctly published, and performs key rollovers.
 
 Danectl lets you create a pair of certbot certificate lineages to be used
 with DANE-aware TLS clients. They are referred to as the "original" and the
-"duplicate", or as the "current" and the "next". The current and next will
-repeatedly swap places between the original and the duplicate certificate
-lineages as the key rolls over from one to the other (with a new "next" key
-being created after each rollover).
+"duplicate", or as the "current" and the "next".
 
     danectl new example.org www.example.org mail.example.org
     danectl dup example.org www.example.org mail.example.org
 
+The current and next will repeatedly swap places between the original and
+the duplicate certificate lineages as the key rolls over from one to the
+other (with a new "next" key being created after each rollover).
+
 If you already have a certbot certificate lineage that you want to use with
 DANE, then instead of creating both certificate lineages, you can adopt the
 existing one for DANE use, and then just create the duplicate.
@@ -35,25 +36,26 @@ existing one for DANE use, and then just create the duplicate.
     danectl dup example.org www.example.org mail.example.org
 
 After that, certbot automatically renews both certificates every few months,
-but the underlying keypairs won't change, and the TLSA records (see below)
-can remain stable.
+but the underlying keys won't change, and the TLSA records (see below) can
+remain stable.
 
 You then configure danectl with the set of port/protocol/host combinations
 that you need TLSA records for.
 
     danectl add-tlsa example.org _443._tcp _443._tcp.www
-    danectl add-tlsa example.org _25._tcp.mail _465._tcp.mail _587._tcp.mail
+    danectl add-tlsa example.org _25._tcp.mail
+    danectl add-tlsa example.org _465._tcp.mail _587._tcp.mail
     danectl add-tlsa example.org _110._tcp.mail _143._tcp.mail
     danectl add-tlsa example.org _993._tcp.mail _995._tcp.mail
     danectl del-tlsa example.org _110._tcp.mail _143._tcp.mail
 
 Danectl can then output the TLSA records, in zonefile format, and you need
-to publish them to the DNS (somehow).
+to publish them in the DNS (somehow).
 
     danectl tlsa-current example.org
     danectl tlsa-next example.org
 
-Danectl can then check that the TLSA records have been published to the DNS.
+Danectl can then check that the TLSA records have been published in the DNS.
 
     danectl tlsa-check example.org
 
@@ -71,8 +73,8 @@ renewals.
 
 You then need to configure your TLS services to use the "current"
 certificate in /etc/letsencrypt/current, and then reload them. This is like
-following instructions for using a certbot certificate, but replacing "live"
-with "current".
+following instructions for using a certbot certificate, but replacing
+"/etc/letsencrypt/live" with "/etc/letsencrypt/current".
 
     Left as an exercise for the reader
 
@@ -82,13 +84,13 @@ Periodically, you can perform key rollovers on a schedule that suits you
     danectl rollover example.org
 
 At any time, you can show the status (which certificate lineages are
-current, which are next, which new TLSA records are not yet published to the
+current, which are next, which new TLSA records are not yet published in the
 DNS, and which old TLSA records have not yet been removed from the DNS).
 
     danectl status
 
 In addition to TLSA records, you can also generate SSHFP, OPENPGPKEY, and
-SMIMEA records, and check that they are published to the DNS.
+SMIMEA records, and check that they are published in the DNS.
 
     danectl sshfp example.org
     danectl sshfp-check example.org