<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div>I got this around the ZSK/KSK around the wrong way (I was a little tired).. And found it already activates the new key is added so the activate is not needed as on the webpage ? Does this look all right now?</div><div>I noticed when you secure a domain it adds an unactivated zsk which I could roll to in the 1st instance ?</div><div><br></div><div>Maybe I should do a lot more reading about this….</div><div><br></div><div><div>or ZSK Roll over..</div><div><br></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnssec show-zone domain.co.nz (find oldkey-id)</span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnssec add-zone-key domain.co.nz zsk 1024</span></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">pdnsec </span></font><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">deactivate-zone-key domain.co.nz <oldkey-id></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnsec </span><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">remove-zone-key domain.co.nz <oldkey-id></span></div></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><span class="Apple-style-span" style="font-family: Calibri, sans-serif; font-size: 14px; "><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">KSK Roll Over</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; "><br></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">pdnssec show-zone domain.co.nz (to find oldkey-id)</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">pdnssec add-zone-key domain.co.nz ksk 2048</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; "><span class="Apple-style-span" style="font-family: Calibri, sans-serif; font-size: 14px; "><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">Send new DS's to upstream (but don't delete the old one) </span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">Wait until the upstream has new DS's in their DNS.</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">Remove old DS's from upstream </span></font></div></span></span></font></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnssec deactivate-zone-key domain.co.nz <oldkey-id></span></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">pdnssec remove-zone-key domain.co.nz <oldkey-id></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; "><br></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; "><br></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; "><br></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">I found the slave does not update at all so I also have to increase the Serial number on the roll overs as well or the slave does not update.. Comments?</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; "><br></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">Thanks</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium; ">Craig</span></font></div></span></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div><div><br></div></body></html>