<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div>The documentation is not 100% clear on how to roll keys over.. Am I right with this? Or can someone right up some better documentation than on <a href="http://doc.powerdns.com/dnssec-operational-doctrine.html">http://doc.powerdns.com/dnssec-operational-doctrine.html</a></div><div><br></div><div>For ZSK Roll over..</div><div><br></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnssec add-zone-key domain.co.nz zsk 2048</span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnssec show-zone domain.co.nz (to find newkey-id)</span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnssec activate-zone-key domain.co.nz <newkey-id></span></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">Send new DS's to upstream (but don't delete the old one) </span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">Wait until the upstream has new DS's</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">Remove old DS's from upstream (can I do this straight away after the upstream has it or can I just wait until I want the roll again to delete/deactivate)</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">pdnsdec </span></font><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">deactivate-zone-key domain.co.nz <oldkey-id></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">pdnsec </span><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">remove-zone-key domain.co.nz <oldkey-id></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">KSK Roll Over</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;"><br></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">pdnssec add-zone-key domain.co.nz ksk 1024</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">pdnssec show-zone domain.co.nz (to find newkey-id)</span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">pdnssec activate-zone-key domain.co.nz <newkey-id></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">pdnssec deactivate-zone-key domain.co.nz <oldkey-id></span></font></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;">pdnssec remove-zone-key domain.co.nz <oldkey-id></span></font></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">Thanks</span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; ">Craig</span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div><div><font class="Apple-style-span" face="luxi sans,sans-serif"><span class="Apple-style-span" style="font-size: medium;"><br></span></font></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div><div><span class="Apple-style-span" style="font-size: medium; font-family: 'luxi sans', sans-serif; "><br></span></div></body></html>