Skip to content

Latest commit

 

History

History
81 lines (60 loc) · 1.92 KB

KNOT-Algorithm-Rollover.md

File metadata and controls

81 lines (60 loc) · 1.92 KB

Algorithm Rollover

Rolling the algorithm will by necessity also roll both KSK and ZSK. During the rollover all RRs will be signed by BOTH keys.

  1. Open the Knot configuration file:
sudo vi /etc/knot/knot.conf
  1. Edit the DNSSEC signing policy and change algorithm for the KSK and ZSK (both must use the same algorithm)
policy:
  - id: lab_p256
    algorithm: RSASHA256
    ...

  1. Save and exit

  2. Verify that the configuration is valid

sudo knotc conf-check
  1. Reload Knot
sudo knotc reload
  1. Check that the new KSK has been generated and is ready to be published
sudo keymgr labbX.examples.nu list
  1. Perform a zone transfer (AXFR) and note that the whole zone is now signed with double signatures:
dig @127.0.0.1 labbX.examples.nu axfr

Knot will automatically phase out the old keys and signatures as it resigns the zone

  1. Show the DS RRs that we are about to publish. Notice that they share the key tag with the KSK:
sudo keymgr labbX.examples.nu ds

  1. Ask your teacher to update the DS in the parent zone.

  2. Wait until the DS has been uploaded. Check the DS with the following command:

dig @ns1.examples.nu labbX.examples.nu DS
  1. We must manually tell the signer that the KSK has been submitted.
sudo knotc zone-ksk-submitted labbX.examples.nu

If the KSK is not yet ready to be submitted, you must wait a bit and try again later.

  1. After the KSK has been submitted, wait for Knot to replace the keys and signatures. Check the key list and note that the old KSK and ZSK has been removed.
sudo keymgr labbX.examples.nu list
dig @127.0.0.1 labbX.examples.nu axfr

  1. Ask your teacher to remove the old DS from the parent zone.

  2. Verify that the old DS has been removed

dig @ns1.examples.nu labbX.examples.nu DS

Next Section: Signing with NSEC3

Testing