<html><body bgcolor="#FFFFFF"><div><span class="Apple-style-span" style="-webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); ">On 17 Sep 2010, at 10:44, Niobos <<a href="mailto:niobos@dest-unreach.be">niobos@dest-unreach.be</a>> wrote:</span><br></div><blockquote type="cite"><div><span></span><br><span>In my opinion, BIND should have resigned this by now: The signature is</span><br><span>valid until a little over 2 days. This means that if the slave would</span><br><span>loose contact with the master right now, it will give out signatures</span><br><span>that will expire before their TTL does.</span><br><span>According to my calculations, RRSIGs should be regenerated zone-expire +</span><br><span>RR-ttl seconds before the RRSIG expires.</span><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" color="#0023A3"><br></font></font></div></blockquote><div><br></div><div>You have to manually set the zone expiry time, TTLs, signature lifetime, and re-signing time consistently.</div><div><br></div>The documentation for 9.7.1 says:<br><div><br></div><span class="Apple-style-span" style="font-family: Times; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); font-size: medium; "><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval">sig-validity-interval</a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; "><br></span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; ">Specifies the number of days into the future when DNSSEC signatures automatically generated as a result of dynamic updates (<a href="http://dotat.at/tmp/arm97/Bv9ARM.ch04.html#dynamic_update" title="Dynamic Update">the section called “Dynamic Update”</a>) will expire. There is an optional second field which specifies how long before expiry that the signatures will be regenerated. If not specified, the signatures will be regenerated at 1/4 of base interval. The second field is specified in days if the base interval is greater than 7 days otherwise it is specified in hours. The default base interval is <code class="literal">30</code> days giving a re-signing interval of 7 1/2 days. The maximum values are 10 years (3660 days).</span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; "><br></span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; ">The signature inception time is unconditionally set to one hour before the current time to allow for a limited amount of clock skew.</span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; "><br></span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; ">The <span><strong class="command">sig-validity-interval</strong></span> should be, at least, several multiples of the SOA expire interval to allow for reasonable interaction between the various timer and expiry dates.</span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; "><span class="Apple-style-span" style="font-family: Helvetica; font-size: 17px; "><br></span></span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; "><span class="Apple-style-span" style="font-family: Helvetica; font-size: 17px; ">Tony.</span></span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; "><span class="Apple-style-span" style="font-family: Helvetica; font-size: 17px; ">-- </span></span></a></strong></span></span></dt><dt><span class="term"><span><strong class="command"><a name="sig-validity-interval"><span class="Apple-style-span" style="font-weight: normal; "><span class="Apple-style-span" style="font-family: Helvetica; font-size: 17px; ">f.anthony.n.finch <dot@dotat.at> http://dotat.at/</span></span></a></strong></span></span></dt></span></body></html>