<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Thank you Yuri, I will do as you comment.<br>
<br>
Juan Carlos<br>
<br>
<div class="moz-cite-prefix">El 10/10/16 a las 15:43, Yuri Schaeffer
escribió:<br>
</div>
<blockquote
cite="mid:773813f8-842f-9f78-f3be-43774fdcda38@nlnetlabs.nl"
type="cite">
<pre wrap="">Hi Juan,
The conf.xml has a <AutomaticKeyGenerationPeriod> in the enforcer
section. If not specified it defaults to a year. If you use a policy
with a very short key lifetime, such as lab, you might want to set it
*much* lower.
<a class="moz-txt-link-freetext" href="https://wiki.opendnssec.org/display/DOCS20/conf.xml#conf.xml-Enforcer">https://wiki.opendnssec.org/display/DOCS20/conf.xml#conf.xml-Enforcer</a>
Best regards,
Yuri
On 10-10-16 11:51, Juan Carlos Rodriguez wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi,
We have compiled the 2.0.1 version to test with our Luna HSM. We have
added one zone for testing (the policy is like "lab" policy but using
our HSM instead of softhsm), and a lot of ZSK keys (1761) have been
created. It is a new behavior or a bug?
Oct 10 11:03:59 dnssectest ods-enforcerd: [enforcer] updatePolicy:
policyName: testfast_safenet
Oct 10 11:03:59 dnssectest ods-enforcerd: [enforcer] updatePolicy: New
key needed for role KSK
Oct 10 11:03:59 dnssectest ods-enforcerd: [enforcer] updatePolicy: got
new key from HSM
Oct 10 11:03:59 dnssectest ods-enforcerd: 1 zone(s) found on policy
"testfast_safenet"
Oct 10 11:03:59 dnssectest ods-enforcerd: [hsm_key_factory_generate] 122
keys needed for 1 zones covering 31536000 seconds, generating 1 keys for
policy testfast_safenet
Oct 10 11:03:59 dnssectest ods-enforcerd: 1 new KSK(s) (2048 bits) need
to be created.
Oct 10 11:04:00 dnssectest ods-enforcerd: [hsm_key_factory_generate] key
generation failed, HSM error: generate key pair: Unknown error
Oct 10 11:04:00 dnssectest ods-enforcerd: 1 zone(s) found on policy
"testfast_safenet"
Oct 10 11:04:00 dnssectest ods-enforcerd: [hsm_key_factory_generate]
2190 keys needed for 1 zones covering 31536000 seconds, generating 1761
keys for policy testfast_safenet
Oct 10 11:04:00 dnssectest ods-enforcerd: 1761 new ZSK(s) (2048 bits)
need to be created.
<Policy name="testfast_safenet">
<Description>Quick turnaround policy for lab
work</Description>
<Signatures>
<Resign>PT10M</Resign>
<Refresh>PT50M</Refresh>
<Validity>
<Default>PT1H</Default>
<Denial>PT1H</Denial>
</Validity>
<Jitter>PT1M</Jitter>
<InceptionOffset>PT30S</InceptionOffset>
</Signatures>
...
<Keys>
<!-- Parameters for both KSK and ZSK -->
<TTL>PT300S</TTL>
<RetireSafety>PT360S</RetireSafety>
<PublishSafety>PT360S</PublishSafety>
<!-- <ShareKeys/> -->
<Purge>PT10S</Purge>
<!-- Parameters for KSK only -->
<KSK>
<Algorithm length="2048">8</Algorithm>
<Lifetime>P3D</Lifetime>
<Repository>SafenetLuna7000</Repository>
</KSK>
<!-- Parameters for ZSK only -->
<ZSK>
<Algorithm length="2048">8</Algorithm>
<Lifetime>PT4H</Lifetime>
<Repository>SafenetLuna7000</Repository>
<!-- <ManualRollover/> -->
</ZSK>
</Keys>
...
</Policy>
Kind regards
--
---------------------------------------------
Juan Carlos Rodríguez Merino
NOC RedIRIS
Tel: 912127620 (Ext. 4345)
RedIRIS / Red.es
Edificio Bronce
Plaza de Manuel Gómez Moreno, s/n - 2ª planta
28020 Madrid
---------------------------------------------
_______________________________________________
Opendnssec-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a>
<a class="moz-txt-link-freetext" href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Opendnssec-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a>
<a class="moz-txt-link-freetext" href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
---------------------------------------------
Juan Carlos Rodríguez Merino
NOC RedIRIS
Tel: 912127620 (Ext. 4345)
RedIRIS / Red.es
Edificio Bronce
Plaza de Manuel Gómez Moreno, s/n - 2ª planta
28020 Madrid
---------------------------------------------</pre>
</body>
</html>