Breadcrumbs

ZSK Rollover

  1. Generate key file for the new ZSK.

›_ Console 

# dnssec-keyfromlabel -E pkcs11 -a RSASHA256 -l "pkcs11:token=Bind;object=zsk1" example.net
tmpzu2qofwc.jpg

Key file for new ZSK

  1. Add the new ZSK to the zone file example.net.

example.net

 
...

$include 

"/usr/local/bin/Kexample.net.+008+60816.key"; //ZSK old

$include "/usr/local/bin/Kexample.net.+008+33663.key"; //ZSK new

...

  1. Re-sign the zone with the KSK and old ZSK.

›_ Console 

# dnssec-signzone -E pkcs11 -x -o example.net -k Kexample.net.+008+33262 /var/named/example.net Kexample.net.+008+60816
tmpywrpynq4.jpg

Signing zone with old ZSK

  1. Wait for the zone transfer time and TTL of the key set.

  2. Sign the zone with new ZSK.

›_ Console 

# dnssec-signzone -E pkcs11 -x -o example.net -k Kexample.net.+008+33262 /var/named/example.net Kexample.net.+008+33663
tmp6b4aqcgg.jpg

Signing zone with new ZSK

  1. Wait for the zone transfer time and maximum TTL used in the zone.

  2. Remove old ZSK from the zone file example.net.

example.net

 
...
$include "/usr/local/bin/Kexample.net.+008+33663.key"; //ZSK new
...

  1. Re-sign the zone with the KSK. Now we have only one ZSK in example.net so it will automatically pick this new ZSK for signing zone.

›_ Console 

# dnssec-signzone -E pkcs11 -x -o example.net -k Kexample.net.+008+33262 /var/named/example.net
tmppmjqpyvh.jpg

Signing zone with new ZSK

  1. Stop and start the named service using below command.

›_ Console 

# /usr/local/sbin/named -f -4 -E pkcs11 -c /usr/local/etc/named.conf
tmpab8mk2rf.jpg

Starting named service

This completes the Integration for Bind9 with Utimaco SecurityServer.