Breadcrumbs

ZSK Rollover

1. Generate key file for new ZSK.

›_ Console 

# dnssec-keyfromlabel -E pkcs11 -a RSASHA256 -l 

"pkcs11:token=Bind;object=zsk1" example.net
tmpfaa90m2v.jpg

Key file for new ZSK

If you want to generate key files for ECC keys, follow steps in section For ECC Keys.

  1. Add the new ZSK to the zone file example.net.

example.net

 
...  
$include "/usr/local/bin/Kexample.net.+008+60816.key"; //ZSK old  
$include "/usr/local/bin/Kexample.net.+008+33663.key"; //ZSK new  
...

  1. Re-sign the zone with the KSK and old ZSK.

›_ Console 

# dnssec-signzone -E pkcs11 -x -o example.net -k Kexample.net.+008+33262 

/var/named/example.net Kexample.net.+008+60816
tmp5617la7s.jpg

Signing zone with old ZSK

  1. Wait for the zone transfer time and TTL of the key set.

  2. Sign the zone with new ZSK.

›_ Console 

# dnssec-signzone -E pkcs11 -x -o example.net -k Kexample.net.+008+33262 

/var/named/example.net Kexample.net.+008+33663
tmpdqmi5e2b.jpg

Signing zone with new ZSK

  1. Wait for the zone transfer time and maximum TTL used in the zone.

  2. Remove old ZSK from the zone file example.net

example.net

 
...  
$include "/usr/local/bin/Kexample.net.+008+33663.key"; //ZSK new  
...

  1. Re-sign the zone with the KSK. Now we have only one ZSK in example.net so it will automatically pick this new ZSK for signing zone.

›_ Console 

# dnssec-signzone -E pkcs11 -x -o example.net -k Kexample.net.+008+33262 /var/named/example.net
tmpcifj2thj.jpg

Signing zone with new ZSK

  1. Stop and start the named service using below command.

›_ Console 

# /usr/local/sbin/named -f -4 -E pkcs11 -c /usr/local/etc/named.conf
tmpf2nla21w.jpg

Starting named service

This completes the Integration for Bind9 with Utimaco CryptoServer HSM.