I’ll use the end of November 2012 for example below.Ī fully working example of a ZSK file being generated so that will be inactivated at the end of November 2012, and then deleted 14 days later should look like below:-ĭnssec-keygen -a RSASHA256 -b 512 -n ZONE -I 20121130 -D 20121214 anime.my This is not at your discretion, the date chosen really cannot be too long than 3 or 4 months from the date of creation, but should be longer than 30 days.
Therefore, if you are reading this in January 2012 for example, set the -I arguement at the end of March 2012 for example. Please take note so that you remember that the ‘Kanime.my.+008+67890.*’ is your ZSK keys.īecause this key is your zone signing key, the date in the -I argeument should be at most 3 or 4 months from creation. Two files will be created in the ‘/var/named/keys/anime.my’ directory, for example, something like ‘Kanime.my.+008+67890.key’ and ‘Kanime.my.+008+67890.private’ files. In the shell, type:-ĭnssec-keygen -a RSASHA256 -b 512 -n ZONE -I -D anime.my Now we move on to creating a zone signing key (ZSK) for the domain. Simple as that.Ī fully working example of a KSK file being generated so that it become inactivated at the end of 2013, and then deleted 14 days later, should look like below:-ĭnssec-keygen -f KSK -a RSASHA512 -b 1024 -n ZONE -I 20131231 -D 20140114 anime.my The date in the -D should be 7 to 14 days after the date you specify in the -I arguement.
I’ll use the end of 2013 for example below. Of course, this is all to your discretion. Therefore, if you are reading this in January 2012 for example, set the -I argument to the end of the 2012 year for example. Please take note so that you remember that the ‘Kanime.my.+010+12345.*’ is your KSK keys.īecause this key is a key signing key file, the date in -I should be quite distant in the future, should be at least a year or so from the time of signing. Two files will be created in the ‘/var/named/keys/anime.my’ directory, for example, something like ‘Kanime.my.+010+12345.key’ and ‘Kanime.my.+010+12345.private’ files. And trust me, you don’t want to deal with dynamic zones which DNSSEC-enabled BIND -D anime.my Older version doesn’t work with this guide. This should remind me how to set up DNSSEC with BIND 9.9 complete with keys rollover scheme that should be painless to implement. This guide is written by myself so that I do not forgot how to do this again in the future.
0 kommentar(er)
