[Opendnssec-user] Version 1.1.0 and KSK rollover logic
sion at nominet.org.uk
Wed Jul 7 09:34:00 UTC 2010
> So, I'm a bit stuck, because the enforcer tells me :
> Jul 7 10:56:20 ns1 ods-enforcerd: WARNING: KSK Retirement reached; please
> submit the new DS for 242.143.79.in-addr.arpa and use ods-ksmutil key
> ksk-roll to roll the key.
> Which I can't do, because the DS can't be accepted :-)
> Chicken, Egg...
This message is during a scheduled rollover and so a replacement key _should_
have been prepublished in the zone.
The situation where the DS exists without the key being in the zone is for a
standby KSK only.
More information about the Opendnssec-user