On 4 Jul 2012, at 14:40, Bas van den Dikkenberg wrote: > Hi i have problem with rrsig's that are expiring. > > In the kaspl it states that the rrsig's must be refresh 3d before they expire. > But opendnssec doesn't refresh them. > > This is in my kaspl.xml > > <Signatures> > <Resign>PT2H</Resign> > <Refresh>P3D</Refresh> > <Validity> > <Default>P7D</Default> > <Denial>P7D</Denial> > </Validity> > <Jitter>PT12H</Jitter> > <InceptionOffset>PT3600S</InceptionOffset> > </Signatures> > > > > But nagios reports: WARNING: check_dnssec_expiration - RRSIG for hobby.nl > expires soon (20120705141400). > > Any sugestions ? >
I have noticed the same problem. I have had time to look into so hadn't posted to the list. Whilst ODS never lets the signatures expire, it does seem to operate outside of its refresh window. Scott Armitage Loughborough University
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Opendnssec-user mailing list [email protected] https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
