generating TSIG keys with 'dnssec-keygen',	get "error reading key file ... bad key type"? 
    jasonsu at mail-central.com 
    jasonsu at mail-central.com
       
    Tue Apr 19 14:40:38 UTC 2016
    
    
  
I'm working on generating TSIG keys for use with my bind server.
When I generate a 2nd set of keys in a dir, I get a "bad key type" error,
	DIR="/home/me/test/nsupdate"
	HOST="myhost.example.com"
	dnssec-keygen -V
		dnssec-keygen 9.10.3-P4
	cd $DIR
	rm -f *
	ls *
		(emtpy)
	dnssec-keygen -a hmac-sha256 -b 128 -K $DIR -n HOST $HOST
		Kmyhost.example.com.+163+35917
	ls *
		Kmyhost.example.com.+163+35917.key
		Kmyhost.example.com.+163+35917.private
	dnssec-keygen -a hmac-sha256 -b 128 -K $DIR -n HOST $HOST
		dnssec-keygen: warning: dns_dnssec_findmatchingkeys: error reading key file Kmyhost.example.com.+163+39520.private: bad key type
	dnssec-keygen: warning: dns_dnssec_findmatchingkeys: error reading key file Kmyhost.example.com.+163+35917.private: bad key type
		Kmyhost.example.com.+163+16588
	ls *
		Kmyhost.example.com.+163+16588.key
		Kmyhost.example.com.+163+16588.private
		Kmyhost.example.com.+163+35917.key
		Kmyhost.example.com.+163+35917.private
>From the manpage
 Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512 automatically set the
           -T KEY option.
So it's auto-set here.  What's "bad" about the automatically set key type?
Jason
    
    
More information about the bind-users
mailing list