<html>Hi<br />This seems really to be complicated part!<br />~4000 Lines of code can be reasons to fail! <br /><br />I am wondering, why there is no "prebuild" solution for this.<br /><br />I don't like to compare pDNS with Bind, but ZSK Rollover is built in since Bind 9.7.<br />... Ok, is only the half story, but does pDNS support automated ZSK (and KSK ) Rollovers in future versions?<br /><br />Regards Adrian<br /><br /><br />On Thu. 5. May 2022 09:50 CEST, Klaus Darilion <klaus.darilion@nic.at> wrote:<br /> <blockquote type="cite" cite="4ad27d6cef124aa9a239a0fb72ca45f4@nic.at">> -----Ursprüngliche Nachricht-----<br />> Von: Pdns-users <pdns-users-bounces@mailman.powerdns.com> Im Auftrag von<br />> Adrian Kägi via Pdns-users<br />> Gesendet: Donnerstag, 5. Mai 2022 09:36<br />> An: pdns-users@mailman.powerdns.com<br />> Betreff: [Pdns-users] Automated DNSSEC Keyrollover<br />><br />> Good day<br />> We use pDNS since a couple of years with a great success in a ISP<br />> environment.<br />> For DNSSEC implementation i made a lab Setup like:<br />> - pdns v 4.7.0 - alpha1<br />> - DNS Multimaster Setup<br />> - Mysql Replication master-> slaves<br />><br />> DNSSEC can be enabled with API call and/or pdnsutil. As our registry<br />> accept CDS records, we have a comftable way to establish the chain of<br />> trust.<br />><br />> Now i like to rollover the ZSK and of course the KSK on a periodical<br />> manner.<br />> I am aware of this two howtos:<br />> https://doc.powerdns.com/authoritative/guides/zskroll.html<br />> https://doc.powerdns.com/authoritative/guides/kskroll.html<br />><br />> Is this the only way for a Key Rollover? Sorry, if i am missed out<br />> something in the Docs!<br />> With hunderts of DNSSEC Domains, the rollover must be automated.<br />><br />> I cloud not find any tested scripts/howto-do-it-in-reallife for pDNS<br />> Rollovers...<br />> How is the pDNS way for a keyrollover in a environment with >100<br />> Domains? ... Life o a Admin... ;)<br /><br />In our case it is ~4000 lines of php code/scripts which:<br />- check the age of KSK/ZSK<br />- create new keys in case of old keys and pre-publish them<br />- calculate when it is safe to use the new keys<br />- activate the new keys<br />- for KSKs track the DS updates in the parent zone<br />- calculate when it is safe to remove the old keys<br />- remove the old keys<br /><br />IMO, all this key handling is muich more complicated then DNSSEC/signing itself.<br /><br /><br />regards<br />Klaus</blockquote><br /><br /><br />-- <pre class="code">Adrian Kägi
Network Engineer
Direct +41 31 517 77 19 | Phone +41 31 517 77 77
NTS Workspace AG colocate lightspeed
Wölflistrasse 1d | CH-3006 Bern | www.nts.ch
</pre></html>