[Opendnssec-user] NOTE: keys generated in repository SoftHSM willnot become active until they have been backed up
rickard at opendnssec.org
Mon Feb 27 13:14:53 UTC 2012
>> The KSK will not become active until you have uploaded the DS RR and
>> said ds-seen to the Enforcer. The first time you sign the zone, the
>> KSK will sign the DNSKEY RRset.
> This is obvious to me but why the KSK is in publish state?
This may explain it:
KSK Publish = Sign the RRset
KSK Ready = The data has propagated
KSK Active = You have uploaded the DS RR.
More information about the Opendnssec-user