Only if KSK has DSState: rumoured. If the DSState is hidden it means that it is not expected to be in the parent (for example because the DNSKEY has not yet been fully propagated).
> Do you need to withdraw the old key too immediatly ? anything else to do ? >>> Do you mean withdraw the old DS? Yes, the old DS should be not yet withdraw because some RRSIG could be still valid ? or can i withdraw the old DS / KSK immediatly ? In my logic : For each file en .state If is KSK with "DSState: rumoured" or "DSState: hidden" If not in my registar (dig ds <my_zone> +dnssec +multiline) Publish on my Registar(api register) Notify Bind(bind rndc dnssec -checkds -key <New ID KSK> published <my_zone>) Notify Bind(bind rndc dnssec -checkds -key <Old ID KSK> withdraw <my_zone>) In my understanding, i shouldn't do "Notify Bind(bind rndc dnssec -checkds -key <Old ID KSK> withdraw <my_zone>)" and wait until all RRSIG sign (with the old KSK) expire. In that case, how can i check this ? (some dig command ? or check state file for "DSState: unretentive" ?) regards, Adrien Le ven. 17 mai 2024 à 15:13, Matthijs Mekking <matth...@isc.org> a écrit : > Hi, > > On 5/16/24 14:02, adrien sipasseuth wrote: > > Hello, > > > > I try to set up a testing environment in order to create some scripts > > for automated the roll over KSK. > > > > ############# question 1 ############# > > this is my policy : > > > > dnssec-policy "test" { > > keys { > > ksk lifetime P3D algorithm ecdsa256 2048; > > zsk lifetime P1D algorithm ecdsa256 2048; > > }; > > > > // Key timings > > purge-keys P4D; > > > > // Signature timings > > signatures-refresh PT50M; > > signatures-validity PT1H; > > signatures-validity-dnskey PT1H; > > > > // Zone parameters > > max-zone-ttl PT1H; > > parent-ds-ttl PT1H; > > > > }; > > > > I would like automaticly update new DS to my registar, to do it this my > > logic : > > > > For each file en .state > > If is KSK with "DSState: rumoured" or "DSState: hidden" > > If not in my registar (dig ds <my_zone> +dnssec +multiline) > > Publish on my Registar(api register) > > Notify Bind(bind rndc dnssec -checkds -key <ID> published > > <my_zone>) > > Only if KSK has DSState: rumoured. If the DSState is hidden it means > that it is not expected to be in the parent (for example because the > DNSKEY has not yet been fully propagated). > > > > Do y need to withdraw the old key too immediatly ? anything else to do ? > > Do you mean withdraw the old DS? > > I would use similar logic but then use "unretentive" instead of > "rumoured". Following the example above: > > For each file en .state > If is KSK with "DSState: unretentive" > If in my registar (dig ds <my_zone> +dnssec +multiline) > Withdraw on my Registar(api register) > Notify Bind(bind rndc dnssec -checkds -key <ID> withdrawn > > > > ############# question 2 ############# > > If i want to unsigned a zone, i change my policy to "insecure" which is > > default but file like <my_zone>.signed still exist, Bind doesn't remove > it ? > > Correct. If all DNSSEC records have been removed, it is safe to remove > the "dnssec-policy" configuration from your named.conf and then remove > the .signed file. > > Unsigning your zone also takes time. > > > > ############# question 3 ############# > > > > In state file, when the remove date issue, can i just remove the key, > > anything else to do ? > > When all states are "hidden" it is safe to remove the key. > > Best regards, > > Matthijs > > > > Regards, > > Adrien SIPASSEUTH > > > > > > > -- > Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe > from this list > > ISC funds the development of this software with paid support > subscriptions. Contact us at https://www.isc.org/contact/ for more > information. > > > bind-users mailing list > bind-users@lists.isc.org > https://lists.isc.org/mailman/listinfo/bind-users >
-- Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information. bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users