Dear List Trying to migrate a zone from auto-dnssec
zone "myzone.ch" { key-directory "/var/lib/bind/keys"; auto-dnssec maintain; inline-signing yes; type master; [...] to dnssec-policy zone "myzone.ch" { key-directory "/var/lib/bind/keys"; dnssec-policy "mypolicy"; inline-signing yes; parental-agents { "quad9"; }; type master; [...] my BIND version 9.18.19 deletes the published and valid keys immediately with newly created ones. As I understand, BIND should make a smooth keyrollover keeping the old keys around for a while and wait until the new keys have a delegation signer record in the parent zone before the old ones get withdrawn and deleted. What am I doing wrong? Thank you for your help. Best regards, Adrian. Relevant log entries: 2023-12-27 23:51:24: zone myzone.ch/IN (signed): reconfiguring zone keys 2023-12-27 23:51:24: keymgr: retire DNSKEY myzone.ch/ECDSAP256SHA256/14076 (KSK) 2023-12-27 23:51:24: keymgr: retire DNSKEY myzone.ch/ECDSAP256SHA256/3654 (ZSK) 2023-12-27 23:51:24: keymgr: DNSKEY myzone.ch/ED25519/2336 (KSK) created for policy mypolicy 2023-12-27 23:51:24: keymgr: DNSKEY myzone.ch/ED25519/35413 (ZSK) created for policy mypolicy 2023-12-27 23:51:24: Permissions on the file /var/lib/bind/keys/Kmyzone.ch. +013+14076.private have changed from 0640 to 0600 as a result of this operation. 2023-12-27 23:51:24: Permissions on the file /var/lib/bind/keys/Kmyzone.ch. +013+03654.private have changed from 0640 to 0600 as a r esult of this opera 2023-12-27 23:51:24: Removing expired key myzone.ch/14076/ECDSAP256SHA256 from DNSKEY RRset. 2023-12-27 23:51:24: DNSKEY myzone.ch/ECDSAP256SHA256/14076 (KSK) is now deleted 2023-12-27 23:51:24: Removing expired key myzone.ch/3654/ECDSAP256SHA256 from DNSKEY RRset. 2023-12-27 23:51:24: DNSKEY myzone.ch/ECDSAP256SHA256/3654 (ZSK) is now deleted 2023-12-27 23:51:24: Fetching myzone.ch/ED25519/2336 (KSK) from key repository. 2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/2336 (KSK) is now published 2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/2336 (KSK) is now active 2023-12-27 23:51:24: Fetching myzone.ch/ED25519/35413 (ZSK) from key repository. 2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/35413 (ZSK) is now published 2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/35413 (ZSK) is now active 2023-12-27 23:51:24: zone myzone.ch/IN (signed): zone_addnsec3chain(1,CREATE, 32,68[...]) 2023-12-27 23:51:24: zone myzone.ch/IN (signed): next key event: 27-Dec-2023 23:56:24.191 My policy looks like: dnssec-policy "mypolicy" { dnskey-ttl 3600; keys { ksk lifetime P5Y algorithm ED25519; zsk lifetime 60d algorithm ED25519; }; nsec3param iterations 32 optout no salt-length 16; publish-safety 1h; retire-safety 7d; }; ...and the parental-agents are Quad9: parental-agents "quad9" { 9.9.9.9; 149.112.112.112; 2620:fe::fe; 2620:fe::9; }; ....the old key has the following times set after the configuration change: $ dnssec-settime -p all /etc/bind/keys/myzone.ch.+013+14076.key Created: Wed Jul 10 10:49:51 2019 Publish: Wed Jul 10 10:49:51 2019 Activate: Wed Jul 10 10:49:51 2019 Revoke: UNSET Inactive: Wed Dec 27 23:51:24 2023 Delete: Fri Jan 5 00:51:24 2024 SYNC Publish: UNSET SYNC Delete: UNSET DS Publish: UNSET DS Delete: UNSET
signature.asc
Description: This is a digitally signed message part.
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users