[Opendnssec-user] kasp.xml Validity tag

[Dupond Mailing]

Hello Yuri,

I solved this problem for others zones by using the "sign" command from 
the ods-signer cli.

But I thought that the signer would have change the signature end time 
every time it runs, right? Now the end time is set to 14 days later. 
I'll keep an eye on it.

Thanks

Le 19/04/2017 à 13:59, Yuri Schaeffer a écrit :
> Hi Gilles,
>
>> Recently, some zones were not secured anymore because of the Validity
>> Period. The reason was that the signature expiration field of the RRSIG
>> RR was too old.
>>
>> For this time, I solved this problem by updating my zone. But I don't
>> want to update all of my zones to avoid this.
> I'm not sure if I understand your problem correctly. OpenDNSSEC is
> specifically designed to do this. So as long as it is running
> (specifically the signer in this case) it should take care or renewing
> signatures.
>
> If you don't want to change your zones after signing and don't want to
> have OpenDNSSEC running you can just set the signature validity to a
> period ending after your retirement and hope someone else will be there
> to deal with it by that time. Is this what you are asking?
>
>> Is there any rule to calculate the Default and Denial durations for non
>> changing zones?
> These durations are configured in that KASP, no calculations required.
> The signature end time might differ from record to record depending on
> time changed and jitter. Though if all records are signed simultaneously
> a 'dig +dnssec' for some record will suffice to read the date on the
> signature.
>
> Best regards,
> Yuri
>
>
>
> _______________________________________________
> Opendnssec-user mailing list
> Opendnssec-user at lists.opendnssec.org
> https://lists.opendnssec.org/mailman/listinfo/opendnssec-user


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20170419/9b6b20a9/attachment.htm>