<div dir="ltr">Hi Matthijs and thank you for your reply.<div><br></div><div>Here is how it goes for me.</div><div><br></div><div>I start with:</div><div><div>Zone: Keytype: State: Date of next transition:</div><div>XXX KSK active 2016-01-16 09:49:45 </div><div>XXX ZSK active 2015-04-18 22:40:55</div></div><div><br></div><div><div>root@debugsigner002:~# ods-hsmutil purge Keyper</div><div>Purging all keys from repository: Keyper</div><div>12 keys found.</div><div><br></div><div>Are you sure you want to remove ALL keys from repository Keyper ? (YES/NO) yes</div><div><br></div><div>Starting purge...</div><div>Key remove successful: fdd17d120d3e548a104dda856d84c770</div><div>...</div><div>Key remove successful: db97ded0cc231c3908f8f20f5ce21229</div><div>Key remove successful: f81e4b2cb33eec780320b6ceeb6f6bb8</div><div>Purge done.</div></div><div><br></div><div>root@debugsigner002:~# /opt/Keyper/PKCS11Provider/inittoken<br></div><div>...</div><div><div>PKCS11 Slot : 0</div><div>PKCS11 Label : aepkeyper </div><div>Keyper Model : Keyper Ent 1126 </div><div>Keyper Serial : </div><div>Keyper version : 2.0</div><div>App : 020</div><div>ABL : 029</div><div>AL : 02</div><div>--------------------------------------------</div><div>Token initialised OK</div><div>********************************************</div></div><div><br></div><div>To remove the zone I actually comment it out from zonelist.xml, then:</div><div><br></div><div><div>root@debugsigner002:~# ods-ksmutil update zonelist</div><div>zonelist filename set to /ods-data/etc/opendnssec/zonelist.xml.</div><div>kasp filename set to /ods-data/etc/opendnssec/kasp.xml.</div><div>Removing zone XXX from database</div><div>Notifying enforcer of new database...</div></div><div><br></div><div>I stopped both ODS daemons.</div><div><br></div><div><div>root@debugsigner002:~# ps auxww | grep ods</div><div>root 14452 0.0 0.0 11744 896 pts/2 S+ 13:31 0:00 grep --color=auto ods</div></div><div><br></div><div>Initialize ODS, all the warnings are skipped, but no errors.</div><div><br></div><div>root@debugsigner002:~# ods-ksmutil setup<br></div><div><br></div><div><div>*WARNING* This will erase all data in the database; are you sure? [y/N] y</div><div>zonelist filename set to /ods-data/etc/opendnssec/zonelist.xml.</div><div>kasp filename set to /ods-data/etc/opendnssec/kasp.xml.</div><div>Repository Keyper found</div><div>No Maximum Capacity set.</div><div>RequireBackup set.</div><div>INFO: The XML in /ods-data/etc/opendnssec/conf.xml is valid</div><div>INFO: The XML in /ods-data/etc/opendnssec/zonelist.xml is valid</div></div><div>INFO: The XML in /ods-data/etc/opendnssec/kasp.xml is valid<br></div><div>Policy XXXTLD found<br></div><div><br></div><div>Generate new keys.</div><div><br></div><div><div>root@debugsigner002:~# ods-ksmutil key generate --policy XXXTLD --zonetotal 1 --interval P2Y</div><div>Key sharing is Off</div><div>Info: converting P2Y to seconds; M interpreted as 31 days, Y interpreted as 365 days</div><div>HSM opened successfully.</div><div>Info: 0 zone(s) found on policy "XXXTLD"</div><div>Info: Keys will actually be generated for a total of 1 zone(s) as specified by zone total parameter</div><div>2 new KSK(s) (2048 bits) need to be created for policy XXXTLD: keys_to_generate(2) = keys_needed(2) - keys_available(0).</div><div>6 new ZSK(s) (1024 bits) need to be created for policy XXXTLD: keys_to_generate(6) = keys_needed(6) - keys_available(0).</div><div>*WARNING* This will create 2 KSKs (2048 bits) and 6 ZSKs (1024 bits)</div><div>Are you sure? [y/N] </div><div>y</div><div>Created KSK size: 2048, alg: 8 with id: 39a954b0fccb0f5ed73614d5fc1a8144 in repository: Keyper and database.</div><div>Created KSK size: 2048, alg: 8 with id: 47dc08d7c5be2104b18a9f7a1702e6b0 in repository: Keyper and database.</div><div>Created ZSK size: 1024, alg: 8 with id: 64504804f1dc34cd44fa83cbede95275 in repository: Keyper and database.</div><div>Created ZSK size: 1024, alg: 8 with id: ec77d359ccdde3e38b222423a5d2075f in repository: Keyper and database.</div><div>Created ZSK size: 1024, alg: 8 with id: 669a0a563fa03c62fc58d20e85628b35 in repository: Keyper and database.</div><div>Created ZSK size: 1024, alg: 8 with id: e799a40efda79c8e98a76adc72470f6d in repository: Keyper and database.</div><div>Created ZSK size: 1024, alg: 8 with id: 0618eb27e1061e37df6bf6a055c85160 in repository: Keyper and database.</div><div>Created ZSK size: 1024, alg: 8 with id: 424fbb66fbaf3605b4d935b473d1be01 in repository: Keyper and database.</div><div>NOTE: keys generated in repository Keyper will not become active until they have been backed up</div><div>all done! hsm_close result: 0</div></div><div><br></div><div>I also mark the keys as backed up.</div><div><br></div><div><div>root@debugsigner002:~# ods-ksmutil backup prepare</div><div>Marked all repositories as pre-backed up at 2014-12-16 13:40:15</div><div>root@debugsigner002:~# ods-ksmutil backup commit</div><div>Marked all repositories as backed up at 2014-12-16 13:40:21</div></div><div><br></div><div>This time I stopped the signer and enforcer before setup, so I start them.</div><div><br></div><div><div>root@debugsigner002:~# ps auxww | grep ods</div><div>opendns+ 14492 0.0 0.5 128840 5548 ? Ss 13:42 0:00 /ods-bin/sbin/ods-enforcerd</div><div>opendns+ 14501 0.0 0.6 533744 7068 ? Ssl 13:42 0:00 /ods-bin/sbin/ods-signerd</div><div>root 14514 0.0 0.0 11744 896 pts/1 S+ 13:45 0:00 grep --color=auto ods</div></div><div><br></div><div>I added the zone, again by editing zonelist.xml and ...</div><div><br></div><div><div>root@debugsigner002:~# ods-ksmutil update zonelist</div><div>zonelist filename set to /ods-data/etc/opendnssec/zonelist.xml.</div><div>kasp filename set to /ods-data/etc/opendnssec/kasp.xml.</div><div>Zone XXX found; policy set to XXXTLD</div><div>Notifying enforcer of new database...</div></div><div><br></div><div>And I end up with the same problem.</div><div><br></div><div><div>Dec 16 13:46:08 debugsigner002 ods-signerd: [hsm] libhsm connection ok</div><div>Dec 16 13:46:08 debugsigner002 ods-signerd: [hsm] unable to get key: key 39a954b0fccb0f5ed73614d5fc1a8144 not found</div><div>Dec 16 13:46:08 debugsigner002 ods-signerd: [zone] unable to publish dnskeys for zone XXX: error creating dnskey</div><div>Dec 16 13:46:08 debugsigner002 ods-signerd: [tools] unable to read zone XXX: failed to publish dnskeys (General error)</div><div>Dec 16 13:46:08 debugsigner002 ods-signerd: [worker[1]] CRITICAL: failed to sign zone XXX: General error</div></div><div><br></div><div>And ods-ksmutil can still list the keys:</div><div><br></div><div>root@debugsigner002:~# ods-ksmutil key list -v<br></div><div><div>Zone: Keytype: State: Date of next transition (to): Size: Algorithm: CKA_ID: Repository: Keytag:</div><div>XXX ZSK active 2015-04-19 13:46:07 (retire) 1024 8 64504804f1dc34cd44fa83cbede95275 Keyper 5680</div><div>XXX KSK publish 2014-12-16 17:51:07 (ready) 2048 8 39a954b0fccb0f5ed73614d5fc1a8144 Keyper 6962</div></div><div><br></div><div>I'll send you the full log off-list.</div><div>Thanks again.</div><div><br></div><div>Emil</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 16, 2014 at 12:18 PM, Matthijs Mekking <span dir="ltr"><<a href="mailto:matthijs@pletterpet.nl" target="_blank">matthijs@pletterpet.nl</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Emil,<br>
<br>
Short: I tried to simulate your use case (with SoftHSM, on<br>
ubuntu-trusty-64 VM), but it seems to work for me. Perhaps I used<br>
slightly different commands? Can you share your used commands?<br>
<br>
Best regards,<br>
Matthijs<br>
<br>
<br>
Audit trail:<br>
<br>
I started with Keys:<br>
Zone: Keytype: State: Date of next transition:<br>
<a href="http://example.com" target="_blank">example.com</a> KSK publish 2014-12-16 23:55:02<br>
<a href="http://example.com" target="_blank">example.com</a> ZSK active 2015-03-16 09:55:02<br>
<span class=""><br>
On 16-12-14 08:54, Emil Natan wrote:<br>
> Good morning,<br>
><br>
> I have a test environment with ODS 1.4.6 and Keyper HSM where signing<br>
> zones was working until I decided to remove all keys and start from scratch.<br>
> I removed all keys with "ods-hsmutil purge"\<br>
<br>
</span>$ sudo ods-hsmutil purge SoftHSM<br>
Purging all keys from repository: SoftHSM<br>
2 keys found.<br>
<br>
Are you sure you want to remove ALL keys from repository SoftHSM ?<br>
(YES/NO) YES<br>
<br>
Starting purge...<br>
Key remove successful: 816416e1255a1724021895b531c0e313<br>
Key remove successful: 615ef6c218cc6bc6d714a0742a07617b<br>
Purge done.<br>
<br>
<br>
> reinitialized the HSM\<br>
<br>
Don't think this is necessary, but okay:<br>
<br>
$ sudo softhsm --init-token --slot 0 --label "OpenDNSSEC"<br>
The SO PIN must have a length between 4 and 255 characters.<br>
Enter SO PIN:<br>
The user PIN must have a length between 4 and 255 characters.<br>
Enter user PIN:<br>
The token has been initialized.<br>
<span class=""><br>
<br>
> removed the single zone I used to sign\<br>
<br>
</span>$ sudo ods-ksmutil zone delete --zone <a href="http://example.com" target="_blank">example.com</a><br>
zonelist filename set to /etc/opendnssec/zonelist.xml.<br>
Zone list updated: 1 removed, 0 added, 0 updated.<br>
<span class=""><br>
<br>
> reinitialized the database "ods-ksmutil setup"\<br>
<br>
</span>I think you should first stop the opendnssec service, but I will not do<br>
that now:<br>
<br>
$ sudo ods-ksmutil setup<br>
*WARNING* This will erase all data in the database; are you sure? [y/N] y<br>
fixing permissions on file /var/opendnssec/kasp.db<br>
zonelist filename set to /etc/opendnssec/zonelist.xml.<br>
kasp filename set to /etc/opendnssec/kasp.xml.<br>
Repository SoftHSM found<br>
No Maximum Capacity set.<br>
RequireBackup NOT set; please make sure that you know the potential<br>
problems of using keys which are not recoverable<br>
INFO: The XML in /etc/opendnssec/conf.xml is valid<br>
INFO: The XML in /etc/opendnssec/zonelist.xml is valid<br>
INFO: The XML in /etc/opendnssec/kasp.xml is valid<br>
WARNING: In policy default, Y used in duration field for Keys/KSK<br>
Lifetime (P1Y) in /etc/opendnssec/kasp.xml - this will be interpreted as<br>
365 days<br>
WARNING: In policy lab, Y used in duration field for Keys/KSK Lifetime<br>
(P1Y) in /etc/opendnssec/kasp.xml - this will be interpreted as 365 days<br>
Policy default found<br>
Info: converting P1Y to seconds; M interpreted as 31 days, Y interpreted<br>
as 365 days<br>
Policy lab found<br>
Info: converting P1Y to seconds; M interpreted as 31 days, Y interpreted<br>
as 365 days<br>
<br>
<br>
> pregenerated new keys\<br>
<br>
But you have no zones currently (you removed the single zone)?<br>
<br>
$ sudo ods-ksmutil key generate --policy default --interval P1Y<br>
Key sharing is Off<br>
Info: converting P1Y to seconds; M interpreted as 31 days, Y interpreted<br>
as 365 days<br>
HSM opened successfully.<br>
Info: 0 zone(s) found on policy "default"<br>
No zones on policy default, skipping...<br>
<br>
<br>
> added a zone\<br>
<br>
$ sudo ods-ksmutil zone add --zone <a href="http://example.com" target="_blank">example.com</a><br>
zonelist filename set to /etc/opendnssec/zonelist.xml.<br>
Imported zone: <a href="http://example.com" target="_blank">example.com</a><br>
<br>
<br>
> updated, restarted all services.<br>
<br>
$ sudo ods-control stop<br>
Stopping enforcer...<br>
Stopping signer engine...<br>
Engine shut down.<br>
<br>
$ sudo ods-control start<br>
Starting enforcer...<br>
OpenDNSSEC ods-enforcerd started (version 1.4.6), pid 28343<br>
Starting signer engine...<br>
OpenDNSSEC signer engine version 1.4.6<br>
Engine running.<br>
<span class=""><br>
> Everything seems to worked well, but the signer does not find one of the<br>
> keys to sign the zone, more specifically the KSK. I went the above<br>
> process few times, always ending with:<br>
><br>
> Dec 16 09:40:27 debugsigner002 ods-signerd: [hsm] unable to get key: key<br>
> f81e4b2cb33eec780320b6ceeb6f6bb8 not found<br>
> Dec 16 09:40:27 debugsigner002 ods-signerd: [zone] unable to publish<br>
> dnskeys for zone XXX: error creating dnskey<br>
> Dec 16 09:40:27 debugsigner002 ods-signerd: [tools] unable to read zone<br>
> XXX: failed to publish dnskeys (General error)<br>
> Dec 16 09:40:27 debugsigner002 ods-signerd: [worker[4]] CRITICAL: failed<br>
> to sign zone XXX: General error<br>
<br>
</span>For me, it finds the old key in the<br>
`/var/opendnssec/tmp/example.com.backup2` file and decides it is corrupted:<br>
<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [hsm] libhsm<br>
connection opened succesfully<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [engine] signer<br>
started (version 1.4.6), pid 28355<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [hsm] unable to<br>
get key: key 615ef6c218cc6bc6d714a0742a07617b not found<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [zone] unable to<br>
publish dnskeys for zone <a href="http://example.com" target="_blank">example.com</a>: error creating dnskey<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [zone] corrupted<br>
backup file zone <a href="http://example.com" target="_blank">example.com</a>: unable to publish dnskeys (General error)<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [engine] unable to<br>
recover zone <a href="http://example.com" target="_blank">example.com</a> from backup, performing full sign<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [signconf] zone<br>
<a href="http://example.com" target="_blank">example.com</a> signconf: RESIGN[PT7200S] REFRESH[PT259200S]<br>
VALIDITY[PT1209600S] DENIAL[PT1209600S] JITTER[PT43200S] OFFSET[PT3600S]<br>
NSEC[50] DNSKEYTTL[PT3600S] SOATTL[PT3600S] MINIMUM[PT3600S]<br>
SERIAL[unixtime]<br>
Dec 16 10:07:59 vagrant-ubuntu-trusty-64 ods-signerd: [STATS]<br>
<a href="http://example.com" target="_blank">example.com</a> 1418724479 RR[count=61 time=0(sec)] NSEC3[count=60<br>
time=0(sec)] RRSIG[new=112 reused=0 time=0(sec) avg=0(sig/sec)]<br>
TOTAL[time=0(sec)]<br>
<span class=""><br>
<br>
> The key exist in both HSM and database. ods-hsmutil lists it:<br>
><br>
> root@debugsigner002:~# ods-hsmutil list | grep<br>
> f81e4b2cb33eec780320b6ceeb6f6bb8<br>
> Keyper f81e4b2cb33eec780320b6ceeb6f6bb8 RSA/2048<br>
><br>
> ods-ksmutil shows it:<br>
><br>
> root@debugsigner002:~# ods-ksmutil key list -v<br>
> Keys:<br>
> Zone: Keytype: State: Date of next<br>
> transition (to): Size: Algorithm: CKA_ID:<br>
> Repository: Keytag:<br>
> XXX KSK active 2016-01-16<br>
> 09:49:45 (retire) 2048 8 f81e4b2cb33eec780320b6ceeb6f6bb8<br>
> Keyper 6061<br>
> XXX ZSK active 2015-04-18<br>
> 22:40:55 (retire) 1024 8 d2aa0ba9af0f41429d23ea387abb836a<br>
> Keyper<br>
><br>
> external tools - dnssec-keyfromlabel can use it.<br>
> No other errors in the log.<br>
><br>
> Any ideas what's wrong? Suggestions what else to try?<br>
> Thanks.<br>
><br>
> Emil<br>
><br>
><br>
><br>
><br>
><br>
</span>> _______________________________________________<br>
> Opendnssec-user mailing list<br>
> <a href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a><br>
> <a href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user" target="_blank">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a><br>
><br>
<br>
_______________________________________________<br>
Opendnssec-user mailing list<br>
<a href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a><br>
<a href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user" target="_blank">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a><br>
</blockquote></div></div>