Is there way to remove the expired sigs bye hand ?
-----Oorspronkelijk bericht----- Van: Scott Armitage [mailto:[email protected]] Verzonden: woensdag 4 juli 2012 15:56 Aan: Bas van den Dikkenberg CC: [email protected] Onderwerp: Re: [Opendnssec-user] RRSIG for hobby.nl expires soon On 4 Jul 2012, at 14:40, Bas van den Dikkenberg wrote: > Hi i have problem with rrsig's that are expiring. > > In the kaspl it states that the rrsig's must be refresh 3d before they expire. > But opendnssec doesn't refresh them. > > This is in my kaspl.xml > > <Signatures> > <Resign>PT2H</Resign> > <Refresh>P3D</Refresh> > <Validity> > <Default>P7D</Default> > <Denial>P7D</Denial> > </Validity> > <Jitter>PT12H</Jitter> > <InceptionOffset>PT3600S</InceptionOffset> > </Signatures> > > > > But nagios reports: WARNING: check_dnssec_expiration - RRSIG for hobby.nl > expires soon (20120705141400). > > Any sugestions ? > I have noticed the same problem. I have had time to look into so hadn't posted to the list. Whilst ODS never lets the signatures expire, it does seem to operate outside of its refresh window. Scott Armitage Loughborough University _______________________________________________ Opendnssec-user mailing list [email protected] https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
