Breadcrumbs

KSK Rollover

  1. Generate a key file for the new KSK.

›_ Console 

/usr/local/bin/dnssec-keyfromlabel -f KSK -a RSASHA256 -l "pkcs11:token=Bind9_RSA;object=ksk1" example.net
11_11.3.1_new_ksk_ref_generation-20260708-090944.png


Key file for new KSK

  1. Sign the zone with the old and new KSK.

›_ Console 

/usr/local/bin/dnssec-signzone -S -o example.net /var/named/example.net
11_11.3.2_sign_zone_with_new_old_ksk-20260708-091549.png


Signing zone with old and new KSK

  1. Wait for the zone transfer time, TTL of DNSKEY resource record set and TTL on the DS record set.

  2. Sign the zone with the new KSK.

›_ Console 

sudo /usr/local/bin/dnssec-signzone -S -o example.net /var/named/example.net
11_11.3.5_sign_zone_with_new_ksk-20260708-185434.png


Signing the zone with new KSK