<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=us-ascii" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000000; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>
<DIV>Hi all,</DIV>
<DIV>Bellow is from my test server and the status of keys make me puzzled, it's
Jul 12 now ,and the key tagged 38478 whose retire date is 2012-07-09 is still
active, and the new ZSK's still ready.</DIV>
<DIV>Should I do a key rollover by "ods-ksmutil keyrollover -z example --keytype
ZSK" manually? Isn't it automatic?</DIV>
<DIV>
<DIV>[root@CST-BJ-104:202.173.9.19 :~]$ods-ksmutil key list -v</DIV>
<DIV>SQLite database set to: /var/opendnssec/kasp.db</DIV>
<DIV>Keys:</DIV>
<DIV>Zone: Keytype: State: Date of next transition (to): Size: Algorithm: CKA_ID: Repository: Keytag:</DIV>
<DIV>example KSK active 2013-07-05 20:48:04 (retire) 2048 8 4f6800a714b360cacaef8f7705b296f4 SoftHSM 3224</DIV>
<DIV>example ZSK active 2012-07-09 21:48:58 (retire) 1024 8 183fa4c0dfcfc41644b83565e228d74d SoftHSM 38478</DIV>
<DIV>example ZSK ready next rollover (active) 1024 8 149877dc0a7382a80936977b36b4f53e SoftHSM 24096</DIV>
<DIV> </DIV>
<DIV>
<DIV>[root@CST-BJ-104:202.173.9.19 :~]$date</DIV>
<DIV>Thu Jul 12 10:18:50 CST 2012</DIV>
<DIV> </DIV>
<DIV>After I ran the rollover command manually,the key status changed:</DIV>
<DIV>
<DIV>[root@CST-BJ-104:202.173.9.19 :~]$ods-ksmutil key list -v</DIV>
<DIV>SQLite database set to: /var/opendnssec/kasp.db</DIV>
<DIV>Keys:</DIV>
<DIV>Zone: Keytype: State: Date of next transition (to): Size: Algorithm: CKA_ID: Repository: Keytag:</DIV>
<DIV>example KSK active 2013-07-05 20:48:04 (retire) 2048 8 4f6800a714b360cacaef8f7705b296f4 SoftHSM 3224</DIV>
<DIV>example ZSK retire 2012-07-12 11:39:47 (dead) 1024 8 183fa4c0dfcfc41644b83565e228d74d SoftHSM 38478</DIV>
<DIV>example ZSK active 2012-07-12 14:28:47 (retire) 1024 8 149877dc0a7382a80936977b36b4f53e SoftHSM 24096</DIV>
<DIV> </DIV>
<DIV>I made <RequireBackup> valid in conf.xml, maybe I did not backup the
new ZSK with command so the automatic did not work properly. So do I have to
monitor the newly auto-created key and make it backup in order not to disturb
the regular key rollover?</DIV>
<DIV> </DIV>
<DIV> </DIV></DIV></DIV></DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV></DIV></BODY></HTML>