[Opendnssec-user] How to calc new ZSK / KSK and pre-publish date
Javier Jiménez Huedo
bodegax at gmail.com
Fri May 16 10:00:01 UTC 2014
The information was very useful for my ;-)
However, something strange is happening with the rollover times:
KSK active 2014-05-20 17:05:53 (retire)
KSK publish 2014-05-19 10:47:20 (ready)
ZSK retire 2014-05-18 16:02:20 (dead)
ZSK active 2014-05-16 11:18:26 (retire)
ZSK publish 2014-05-18 19:14:46 (ready)
ZSK active key goes to "retire" status before the new ZSK key changes to
Something similar happens with the KSK key.
I think the current active key must continue as "active" till the next key
can be "ready" ... Is that correct?
Why these inconsistencies appear?
I tried that new keys to be published several days before the rollover
takes place. The only way (I have found) to achieve that is by modifying
"PropagationDelay" parameter of the "zone" section for the ZSK and the
"Parent" for the KSK key.
Is it correct? Does exists any other way to do that?
Thank you very much
2014-05-14 14:57 GMT+02:00 Sion Lloyd <sion at nominet.org.uk>:
> To paraphrase the key timings draft:
> * A key in the "publish" state moves into the "ready" state when it
> * been published for at least:
> * Ipc = TTLkeyc + Dpc +Sp
> * ... where:
> * TTLkeyc = TTL of the ZSK DNSKEY record
> * Dpc = Propagation delay
> * Sp = Publish Safety Margin
> OpenDNSSEC will attempt to publish a key at least this far ahead of the
> previous ZSK's retire time. It is slightly complicated by the run interval
> of the enforcer, so might be a bit earlier.
> Generation may be as required (i.e. it will be generated and published at
> the same time) or you may generate a whole batch of keys ahead of schedule.
> *From:* opendnssec-user-bounces at lists.opendnssec.org [
> opendnssec-user-bounces at lists.opendnssec.org] on behalf of Javier Jiménez
> Huedo [bodegax at gmail.com]
> *Sent:* 13 May 2014 13:18
> *To:* opendnssec-user at lists.opendnssec.org
> *Subject:* [Opendnssec-user] How to calc new ZSK / KSK and pre-publish
> Dear OpenDNSSEC users,
> I am confused about the following behavior of openDNSSEC:
> I have the following ZSK active key:
> Key type State: Next transition:
> ZSK active 2014-05-19 16:02:20 (retire)
> KSK Lifetime P20D
> ZSK LifeTime P10D
> How I can calculate the date of generation of the next ZSK key?
> How I can calculate the date of pre-publication next ZSK key?
> <SOA><TTL>P1D</TTL> <Minimum>P1D</Minimum></SOA>
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Opendnssec-user