<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 27/08/12 07:01, Áõ˶ wrote:<br>
</div>
<blockquote cite="mid:201208271401037599571044@126.com" type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<style>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: 宋体; COLOR: #000000; FONT-SIZE: 10.5pt
}
</style>
<meta name="GENERATOR" content="MSHTML 8.00.6001.18702">
<div><span>Hi,</span></div>
<div><span></span> </div>
<div><span>I'm testing KSK rollover, when the newly created KSK is
set active by ds-seen, the old KSK became retired, but the
DNSKEY is still signed by the old KSK after resigning , the
new KSK is not used at all. I used to think there should be
two RRSIG </span><span>DNSKEYs because of Double Signing.
When will the new KSK be used for signing? When will the old
KSK get deleted? The DS is valid in parent zone now, but I can
not delete the old DS because new KSK is not used by
ods-signer.</span></div>
<div><span></span> <br>
</div>
</blockquote>
<br>
Hi Stuart.<br>
<br>
Is it possible that something is preventing the signconf xml file
from being written? If this is the case then the signer will not
change the keys it uses.<br>
<br>
Sion<br>
</body>
</html>