[Opendnssec-user] manual key rollover results in "1970-01-01 01:00:00"
dennis at baaten.com
Mon Nov 13 13:24:59 UTC 2017
I discovered a problem, and this might get me closer to a solution. I'm running Debian stable (stretch) and installed opendnssec from Debian testing (buster). I did this with the command "apt-get install opendnssec/testing", but this command installs opendnssec from testing (2.1.3 release) and gets it's dependencies from stable (2.0 release) including opendnssec-common which contains older versions of ods-signer and ods-enforcer (from the 2.0 release). In order to correct this I ran "apt-get -t testing install opendnssec-common", which installs dependencies from testing as well. So now all application files are from the 2.1.3 release.
The 1970 is gone.
root at traxotic [/var/lib/opendnssec/signconf]$ ods-enforcer key list --verbose | grep dennisbaaten
key list completed in 0 seconds.
dennisbaaten.com ZSK retire 2017-11-14 14:36:34 2048 8 ce3507796d7c176695bbfdc18f100fc6 SoftHSM 52924
dennisbaaten.com ZSK active 2017-11-14 14:36:34 2048 8 49bad7794a2e2c4d5f44755f33317982 SoftHSM 11619
dennisbaaten.com KSK active 2017-11-14 14:36:34 4096 8 f82e46fa26d4772c3b09db259aa41a30 SoftHSM 59792
dennisbaaten.com ZSK retire 2017-11-14 14:36:34 2048 8 75602642359504fa4d1decc0d7ab37e4 SoftHSM 40563
dennisbaaten.com KSK publish 2017-11-14 14:36:34 4096 8 27384557fb5980c2b8fff0139e0d76e9 SoftHSM 32179
dennisbaaten.com ZSK publish 2017-11-14 14:36:34 2048 8 925276e53f3ac23420b34ed5f24d4892 SoftHSM 58128
and there seems to be something in the queue:
root at traxotic [/var/lib/opendnssec/signconf]$ ods-enforcer queue
There is 1 task scheduled.
It is now Mon Nov 13 14:15:36 2017 (1510578936 seconds since epoch)
Next task scheduled Mon Nov 13 14:16:06 2017 (1510578966 seconds since epoch)
On Mon Nov 13 14:16:06 2017 I will [enforce] next zone
queue completed in 0 seconds.
The DB 2006 error in syslog persists. Not sure if this is causing troubles at this moment.
The signconf file is not updated after ods-enforcer enforce (timestamp still the same).
The signed zone files are also not updated (same timestamp).
My initial guess is that tomorrow at the "Date of next transition" the rollovers will actually take place. If not, I will report back to the mailinglist.
More information about the Opendnssec-user