Hi Gilles, > Recently, some zones were not secured anymore because of the Validity > Period. The reason was that the signature expiration field of the RRSIG > RR was too old. > > For this time, I solved this problem by updating my zone. But I don't > want to update all of my zones to avoid this.
I'm not sure if I understand your problem correctly. OpenDNSSEC is specifically designed to do this. So as long as it is running (specifically the signer in this case) it should take care or renewing signatures. If you don't want to change your zones after signing and don't want to have OpenDNSSEC running you can just set the signature validity to a period ending after your retirement and hope someone else will be there to deal with it by that time. Is this what you are asking? > Is there any rule to calculate the Default and Denial durations for non > changing zones? These durations are configured in that KASP, no calculations required. The signature end time might differ from record to record depending on time changed and jitter. Though if all records are signed simultaneously a 'dig +dnssec' for some record will suffice to read the date on the signature. Best regards, Yuri
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Opendnssec-user mailing list [email protected] https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
