[Opendnssec-user] RRSIG for hobby.nl expires soon

[Scott Armitage]

On 4 Jul 2012, at 14:40, Bas van den Dikkenberg wrote:

> Hi i have problem with rrsig's that are expiring.
> 
> In the kaspl it states that the rrsig's must be refresh 3d before they expire.
> But opendnssec doesn't refresh them.
> 
> This is in my kaspl.xml
> 
>                <Signatures>
>                        <Resign>PT2H</Resign>
>                        <Refresh>P3D</Refresh>
>                        <Validity>
>                                <Default>P7D</Default>
>                                <Denial>P7D</Denial>
>                        </Validity>
>                        <Jitter>PT12H</Jitter>
>                        <InceptionOffset>PT3600S</InceptionOffset>
>                </Signatures>
> 
> 
> 
> But nagios reports: WARNING: check_dnssec_expiration - RRSIG for hobby.nl expires soon (20120705141400).
> 
> Any sugestions ?
> 


I have noticed the same problem. I have had time to look into so hadn't posted to the list.  Whilst ODS never lets the signatures expire, it does seem to operate outside of its refresh window.



Scott Armitage
Loughborough University
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 203 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20120704/c0ec724c/attachment.bin>