Hi folks,
Summary: Is there a trick to running dnssec-coverage so that it will not
report failure if there are coverage gaps in the 'distant' past?
Detail:
I've performed a key rollover, and dnssec-coverage reports:
===
PHASE 1--Loading keys to check for internal timing problems
PHASE 2--Scanning future key events for coverage failures
Checking scheduled KSK events for zone palatine.ac.uk, algorithm
RSASHA256...
Thu Apr 24 08:56:09 UTC 2014:
Publish: palatine.ac.uk/008/04681 (KSK)
Activate: palatine.ac.uk/008/04681 (KSK)
Thu May 01 15:02:35 UTC 2014:
Publish: palatine.ac.uk/008/37960 (KSK)
Sat May 31 15:02:35 UTC 2014:
Activate: palatine.ac.uk/008/37960 (KSK)
Inactive: palatine.ac.uk/008/04681 (KSK)
Sun Jun 29 15:02:35 UTC 2014:
Delete: palatine.ac.uk/008/04681 (KSK)
No errors found
Checking scheduled ZSK events for zone palatine.ac.uk, algorithm
RSASHA256...
Thu Apr 24 08:56:38 UTC 2014:
Publish: palatine.ac.uk/008/27594 (ZSK)
Activate: palatine.ac.uk/008/27594 (ZSK)
Wed May 07 11:36:59 UTC 2014:
Publish: palatine.ac.uk/008/30231 (ZSK)
Thu May 08 11:36:59 UTC 2014:
Inactive: palatine.ac.uk/008/27594 (ZSK)
Activate: palatine.ac.uk/008/30231 (ZSK)
Thu Jun 05 11:36:59 UTC 2014:
Delete: palatine.ac.uk/008/27594 (ZSK)
No errors found
===
As the ZSK palatine.ac.uk/008/27594 has been deleted from the zone, I'd
like to simplify the key directory by removing the now unused key
material. When I do so, named continues happily (the zone is
inline-signed), and there are no warnings when it rescans the key directory.
However, dnssec-coverage now complains:
===
PHASE 1--Loading keys to check for internal timing problems
PHASE 2--Scanning future key events for coverage failures
Checking scheduled KSK events for zone palatine.ac.uk, algorithm
RSASHA256...
Thu Apr 24 08:56:09 UTC 2014:
Publish: palatine.ac.uk/008/04681 (KSK)
Activate: palatine.ac.uk/008/04681 (KSK)
Thu May 01 15:02:35 UTC 2014:
Publish: palatine.ac.uk/008/37960 (KSK)
Sat May 31 15:02:35 UTC 2014:
Activate: palatine.ac.uk/008/37960 (KSK)
Inactive: palatine.ac.uk/008/04681 (KSK)
Sun Jun 29 15:02:35 UTC 2014:
Delete: palatine.ac.uk/008/04681 (KSK)
No errors found
Checking scheduled ZSK events for zone palatine.ac.uk, algorithm
RSASHA256...
Wed May 07 11:36:59 UTC 2014:
Publish: palatine.ac.uk/008/30231 (ZSK)
ERROR: No ZSK's are active after this event
===
If dnssec-coverage continued processing and got to May the 8th, it
(should) find that the key became active.
Is there a trick to ask dnssec-coverage to ignore gaps in the distant (>
TTL?) past, or do I need to keep all of the keys ever used on the zone
in the key directory, if I wish to use dnssec-coverage?
Graham
--
Graham Clinch
Systems Programmer,
Lancaster University
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
