[Opendnssec-user] KSK rollover process
rickard.bellgrim at iis.se
Tue Dec 8 08:10:44 UTC 2009
-----BEGIN PGP SIGNED MESSAGE-----
> We are encountering a problem with the manual KSK rollover process.
> Before initiating the rollover, we have two KSK keys: one active and
> standby key in a READY state. So, everything should be ready for the
> rollover. Now, when we initiate the KSK rollover with the ods-ksmutil
> command, the following happens:
> 1. The signer generates a new standby key that enters a PUBLISHED state
> 2. The new standby KSK is added to the zone DNSKEY RRset
We do this because still want to have a standby key after this rollover.
> 3. The DNSKEY RRset is still signed with (and only with) the old active
We use the so called "Pre-Publication Method" and not "Double-Signature Method"
> 4. The new standby KSK becomes READY after a while
> 5. Finally we have three KSKs, one active and two standby KSKs in READY
> state. The DNSKEY RRset is still signed with (and only with) the old
> active KSK.
This is also as expected. The command that you haven't given to the system is the ksk-roll.
> So, except adding a new standby KSK to the DNSKEY RRset, nothing really
> seems to happen. As far as I understand, the DNSKEY RRset should be
> signed with both the old active and old standby KSK immediately after
> giving the rollover command, because we already had a standby KSK in
> READY state before giving the rollover command? Further, the retirement
> timers of the old KSK should probably start after giving the
> "ds-seen" (or "ksk-roll") command? But, before having the double
> signatures we are unable to publish the new DS and give the "ds-seen"
> command in the first place, right?
> Are we perhaps missing something or is this a bug in the signer or in
> the enforcer? We are using 1.0.0rc1-trunk.
You first initiate the rollover by giving the command "ods-ksmutil key rollover --zone <Name of zone> --keytype KSK". This will start the "Pre-Publication" process. But since you have a standby key, you do not need to wait until the new key gets ready (your standby key is already ready).
You now need to publish your DS record. "ods-ksmutil key export --zone <Name of zone> --keystate ready --ds". Use the keytag from the DS record and finalize the rollover once you have seen your DS record in the parent zone. "ods-ksmutil key ksk-roll --zone <Name of zone> --keytag <Keytag>"
Only use the ksk-roll-command for the key that you intend to roll over to, because this command will retire the currently active KSK.
-----BEGIN PGP SIGNATURE-----
Version: 9.8.3 (Build 4028)
-----END PGP SIGNATURE-----
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Opendnssec-user