Oops.
I had it all figured out about 2 months ago and had generated new
keys for ZSK (which I rolled over right away) and KSK. The KSK
change was slated for yesterday, but I forgot to get the DS to the
parent zone before the inactivation of the previous KSK.
Sigh, it sure would be nice if I had a registrar with a means to
automate DS submission. But it's my fault for failing to set a
reminder to do it manually.
I put a bandaid on the problem with dnssec-settime(8). With that I
reactivated the old dead key (this has me feeling a bit like
Frankenstein! :) ) I added a week to inactivation,
# dnssec-settime -I+1w Knodns4.us.+005+60073.key
I thought I should then try deactivating the new one, but
dnssec-settime did not like what I tried:
# dnssec-settime -i6d -S Knodns4.us.+005+60073.key Knodns4.us.+005+16408.key
dnssec-settime: fatal: Predecessor will become inactive before the
prepublication period ends. Either change its inactivation
date, or use the -i option to set a shorter prepublication
interval.
I don't understand this error. 1w > 6d, right?
At this time I have 3 RRSIGs for DNSKEY: from both KSKs and the ZSK.
According to both DNSViz and Verisign's dnssec-debugger this has put
me back in business for the time being. For some reason I am not
successful in wrestling with Godaddy over the new DS, but that's not
a matter for this list.
--
http://rob0.nodns4.us/
Offlist GMX mail is seen only if "/dev/rob0" is in the Subject:
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
