<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi Christoph,<br>
<br>
Firstly I should say that the current key will not be retired
until you say that the new key has appeared in the DNS... I.e. it
will live on past retirement while no key is in place to take
over.<br>
<br>
That new key must have been published at some point, but I can't
tell when from your email. Are you giving the enforcer time to run
with the changed dates before you run the key list command?<br>
<br>
Finally, where do you get your 10 day timer from?<br>
<br>
Sion<br>
<br>
On 15/07/14 15:26, <a class="moz-txt-link-abbreviated" href="mailto:Christoph.Malin@vtg.at">Christoph.Malin@vtg.at</a> wrote:<br>
</div>
<blockquote
cite="mid:11F22C5BEC3B25459E3FED2F2F79FB4A6A6A69@EGVBRVEX2.egv.at"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m playing around with opendnssec. <span
lang="EN-US">I added a zone to openddnssec and it was
signed.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Then I changed the date
of the Server to (12.07.2015) a few dates before the KSK
retires.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">In the log file:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Rollover of KSK expected
at 2015-07-15 18:20:53 for vtg.at<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Also when I print the
current keys:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">vtg.at
KSK active 2015-07-15 18:20:53 (retire)
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Then I changed the date
to 2015-07-16. Suddenly a second KSK was here.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">vtg.at
KSK ready waiting for ds-seen (active) 2048<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Why was the key not
generated before the retire? I want that the key gets
generated 10 days before he expires.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Otherwise the chain of
trust is broken.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Can anybody help me?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
<p class="MsoNormal">Christoph<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Opendnssec-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a>
<a class="moz-txt-link-freetext" href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a>
</pre>
</blockquote>
<br>
</body>
</html>