<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Ok, your example is very clear. That's
the configuration I have right now. <br>
<br>
So if I understand, if the signature end time is set to the 3rd
may, it must be change the 30th april or 1st may.<br>
<br>
Thank you,<br>
<br>
Gilles<br>
<br>
Le 19/04/2017 à 15:42, Yuri Schaeffer a écrit :<br>
</div>
<blockquote
cite="mid:78e94ffe-07e2-93b6-9864-c3f01cd7d352@nlnetlabs.nl"
type="cite">
<blockquote type="cite">
<pre wrap="">But I thought that the signer would have change the signature end time
every time it runs, right? Now the end time is set to 14 days later.
I'll keep an eye on it.
</pre>
</blockquote>
<pre wrap="">
Not entirely. There are 3 variables in play here:
- Validity period (default and denial)
- Resign Interval
- Refresh period
The Validity period is the period in which signatures are usable by
validators (i.e. the timestamps you see when 'digging' a record). The
resign interval is the amount of time the signer waits between checks to
see if any work needs to be done for that policy. It is dormant in
between unless you prod it manually by giving it commands on the CLI.
Last, the refresh period is the time BEFORE the end of the validity
period in which the signer will regenerate signatures that are about to
expire.
So most of the time when the signer runs (resign Interval) it will do
nothing for a particular signature. Unless that signature is about to
expire (Tnow > Tsignature + Ivalidity - IRefresh).
The idea is of course that (Iresign < Irefresh < Ivalidity).
So for example Signatures are valid for 14 days, refresh them if they
expire within 3 days, and check for that condition every 2 hours.
//Yuri
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Opendnssec-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Opendnssec-user@lists.opendnssec.org">Opendnssec-user@lists.opendnssec.org</a>
<a class="moz-txt-link-freetext" href="https://lists.opendnssec.org/mailman/listinfo/opendnssec-user">https://lists.opendnssec.org/mailman/listinfo/opendnssec-user</a>
</pre>
</blockquote>
<p><br>
</p>
</body>
</html>