Breadcrumbs

Key Rollover

  1. OpenDNSSEC also provides the option for Manual rollover of the keys. To display the Rollover date of the keys for a zone, use the command below.

›_ Console 

# ods-enforcer rollover list -z test.com
image-3285123223-1.jpg

Rollover key list output

Automatic Rollover of KSK (Key-Signing Keys) and ZSK (Zone-Signing Keys) is supported with Utimaco HSM, and it happens as per the policy configured in kasp.xml. For more detailed information about the Key States and Key Rollover visit the official OpenDNSSEC documentation at https://wiki.opendnssec.org/.

  1. Use the command to roll the KSK manually. This will roll the KSK key in a timely manner following the policy used for the zone test.com.

›_ Console 

# ods-enforcer key rollover --zone test.com --keytype KSK
image-3285123223-3.jpg

Manually rollover KSK output

Similarly, if a user wants to manually rollover ZSK, replace --keytype with ZSK.

›_ Console 

# ods-enforcer key rollover --zone test.com --keytype ZSK
image-3285123223-4.jpg

Manually rollover ZSK output

  1. Verify that the key has been rolled over successfully.

›_ Console 

# ods-enforcer rollover list
image-3285123223-5.jpg

Rollover key list output

This completes the integration of OpenDNSSEC with Utimaco HSM.