Breadcrumbs

ZSK Rollover

  1. Generate key file for the new ZSK.

›_ Console 

/usr/local/bin/dnssec-keyfromlabel -a RSASHA256 -l "pkcs11:token=Bind9_RSA;object=zsk1" example.net
11_11.4.1_new_zsk_ref_generation-20260708-193352.png


Key file for new ZSK

  1. Sign the zone with the new and old ZSK.

›_ Console 

/usr/local/bin/dnssec-signzone -S -o example.net /var/named/example.net
11_11.4.2_sign_zone_with_new_old_ksk-20260708-210122.png


Signing zone with old and new ZSK

  1. Wait for the zone transfer time and maximum TTL used in the zone.

  2. Re-sign the zone with the new ZSK. Now we have only one ZSK in example.net so it will automatically pick this new ZSK for signing zone.

›_ Console 

 /usr/local/bin/dnssec-signzone -S -o example.net /var/named/example.net
11_11.4.5_sign_zone_with_new_zsk-20260708-224731.png


Signing the zone with new ZSK

  1. Verify new signed zone.

/usr/local/bin/dnssec-verify -z -o example.net /var/named/example.net.signed
11_11.5_new_signed_zone_verify-20260708-231610.png


New signed zone

  1. Restart the named service using below command.

›_ Console 

/usr/local/sbin/named -f -4 -g -c /usr/local/etc/named.conf
11_11.6_Bind9_restart-20260708-231640.png


Starting named service

This completes the Integration for Bind9 with Utimaco SecurityServer.