- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
DNSSEC - KSK Rollover
[ Edited ]- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-24-2021 05:05 PM - edited 10-24-2021 08:19 PM
Hello,
I have a DNSSEC singed zone with the default KSK Rollover period of 1 year. I want to know what happens after 1 year when the rollover period expires naturally.
I understand that a new KSK key pair gets generated and the DNSKEY record set is signed with it and since Double-Sign method is used the old KSK is also valid until the grace period.
So what is the grace period when the KSK expires naturally?
If its half the rollover period i.e 182.5 days then do I have this much time to update the registrar with the new DS record?
Once the new DS record has been updated at the registar I wait for the TTL and then remove the old DS record. Then again wait for the TTL to expire and then remove the old KSK from the zone? Is this the correct way to perform a seamless rollover?
Thank you.
Re: DNSSEC - KSK Rollover
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-13-2023 09:23 AM
Giving this thread a bump, as I have the exact same questions and I am working on deploying DNSSEC on several of our zones.
Re: DNSSEC - KSK Rollover
[ Edited ]- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
11-14-2023 12:36 AM - edited 11-14-2023 12:38 AM
I am currently testing on this in my lab according to manual that supplied by Infoblox. https://insights.infoblox.com/resources-deployment-guides/infoblox-deployment-guide-dnssec
What i noticed if KSK expired (assuming after 365 days), the entire signed zones will become BOGUS. You should be able to noticed the validity of your DNSSEC record through dig www.example.com +dnssec
www.example.com. 300 IN RRSIG A 8 3 300 20231116065751(valid before) 20231114055751(valid after)
Just to share the below link for more reads-up
Re: DNSSEC - KSK Rollover
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wednesday
Same question here.