Dear List Trying to migrate a zone from auto-dnssec
zone "myzone.ch" {
key-directory "/var/lib/bind/keys";
auto-dnssec maintain;
inline-signing yes;
type master;
[...]
to dnssec-policy
zone "myzone.ch" {
key-directory "/var/lib/bind/keys";
dnssec-policy "mypolicy";
inline-signing yes;
parental-agents { "quad9"; };
type master;
[...]
my BIND version 9.18.19 deletes the published and valid keys immediately with
newly created ones.
As I understand, BIND should make a smooth keyrollover keeping the old keys
around for a while and wait until the new keys have a delegation signer record
in the parent zone before the old ones get withdrawn and deleted.
What am I doing wrong?
Thank you for your help.
Best regards, Adrian.
Relevant log entries:
2023-12-27 23:51:24: zone myzone.ch/IN (signed): reconfiguring zone keys
2023-12-27 23:51:24: keymgr: retire DNSKEY myzone.ch/ECDSAP256SHA256/14076
(KSK)
2023-12-27 23:51:24: keymgr: retire DNSKEY myzone.ch/ECDSAP256SHA256/3654
(ZSK)
2023-12-27 23:51:24: keymgr: DNSKEY myzone.ch/ED25519/2336 (KSK) created for
policy mypolicy
2023-12-27 23:51:24: keymgr: DNSKEY myzone.ch/ED25519/35413 (ZSK) created for
policy mypolicy
2023-12-27 23:51:24: Permissions on the file /var/lib/bind/keys/Kmyzone.ch.
+013+14076.private have changed from 0640 to 0600 as a result of this
operation.
2023-12-27 23:51:24: Permissions on the file /var/lib/bind/keys/Kmyzone.ch.
+013+03654.private have changed from 0640 to 0600 as a r
esult of this opera
2023-12-27 23:51:24: Removing expired key myzone.ch/14076/ECDSAP256SHA256 from
DNSKEY RRset.
2023-12-27 23:51:24: DNSKEY myzone.ch/ECDSAP256SHA256/14076 (KSK) is now
deleted
2023-12-27 23:51:24: Removing expired key myzone.ch/3654/ECDSAP256SHA256 from
DNSKEY RRset.
2023-12-27 23:51:24: DNSKEY myzone.ch/ECDSAP256SHA256/3654 (ZSK) is now
deleted
2023-12-27 23:51:24: Fetching myzone.ch/ED25519/2336 (KSK) from key
repository.
2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/2336 (KSK) is now published
2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/2336 (KSK) is now active
2023-12-27 23:51:24: Fetching myzone.ch/ED25519/35413 (ZSK) from key
repository.
2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/35413 (ZSK) is now published
2023-12-27 23:51:24: DNSKEY myzone.ch/ED25519/35413 (ZSK) is now active
2023-12-27 23:51:24: zone myzone.ch/IN (signed): zone_addnsec3chain(1,CREATE,
32,68[...])
2023-12-27 23:51:24: zone myzone.ch/IN (signed): next key event: 27-Dec-2023
23:56:24.191
My policy looks like:
dnssec-policy "mypolicy" {
dnskey-ttl 3600;
keys {
ksk lifetime P5Y algorithm ED25519;
zsk lifetime 60d algorithm ED25519;
};
nsec3param iterations 32 optout no salt-length 16;
publish-safety 1h;
retire-safety 7d;
};
...and the parental-agents are Quad9:
parental-agents "quad9" {
9.9.9.9;
149.112.112.112;
2620:fe::fe;
2620:fe::9;
};
....the old key has the following times set after the configuration change:
$ dnssec-settime -p all /etc/bind/keys/myzone.ch.+013+14076.key
Created: Wed Jul 10 10:49:51 2019
Publish: Wed Jul 10 10:49:51 2019
Activate: Wed Jul 10 10:49:51 2019
Revoke: UNSET
Inactive: Wed Dec 27 23:51:24 2023
Delete: Fri Jan 5 00:51:24 2024
SYNC Publish: UNSET
SYNC Delete: UNSET
DS Publish: UNSET
DS Delete: UNSET
signature.asc
Description: This is a digitally signed message part.
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
