<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">Hello,</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">We’re testing DNSSEC system with bind-9.10.3-P4, openssl-1.0.1t and Utimaco HSM.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">My system can operate normally in manual signing mode. But when I change to inline signing mode, the system cannot resign domain zones after dnssec-loadkeys-interval
(60 minutes by default).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 10pt; line-height: 115%; font-family: 'Courier New';">I configure zone options in named.conf to inline-signing mode:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">zone "dnssec.test" in {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New""> type master;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New""> file "db.dnssec.test";<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt;text-indent:36.0pt"><span style="font-size:10.0pt;line-height:115%;font-family:"Courier New"">key-directory "/data/dnssec/keys/dnssec.test/";<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt;text-indent:36.0pt"><span style="font-size:10.0pt;line-height:115%;font-family:"Courier New"">auto-dnssec maintain;<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt;text-indent:36.0pt"><span style="font-size:10.0pt;line-height:115%;font-family:"Courier New"">inline-signing yes;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">};<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New""> </span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">Change openssl.cnf to support automatically resign domain zones:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">openssl_conf = openssl_def<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">[ openssl_def ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">engines = engine_section<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">[ engine_section ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">pkcs11 = pkcs11_section<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">[ pkcs11_section ]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">PIN = xxxxx<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New""> </span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">And then I restart named and the system can resign automatically when new records inserted via nsupdate command. But after dnssec-loadkeys-interval (60 minutes by
default), bind cannot load private key from HSM to resign zone.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New""> </span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">This is log of bind:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 11:47:28.557 general: info: zone dnssec.test/IN (signed): loaded serial 2016051809<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 11:47:28.558 general: error: zone dnssec.test/IN (signed): receive_secure_serial: unchanged<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 11:47:28.558 general: info: zone dnssec.test/IN (signed): reconfiguring zone keys<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 11:55:14.046 general: info: received control channel command 'signing -list dnssec.test'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 12:00:49.378 general: info: received control channel command 'loadkeys dnssec.test'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 12:00:49.378 general: info: zone dnssec.test/IN (signed): reconfiguring zone keys<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 12:00:49.383 general: info: zone dnssec.test/IN (signed): next key event: 02-Jun-2016 13:00:49.378<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 13:00:49.378 general: info: zone dnssec.test/IN (signed): reconfiguring zone keys<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 13:00:49.379 general: warning: ENGINE_load_private_key failed (not found)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 13:00:49.380 general: info: error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:126:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;line-height:115%;font-family:
"Courier New"">02-Jun-2016 13:00:49.380 general: warning: dns_dnssec_keylistfromrdataset: error reading private key file dnssec.test/RSASHA256/4494: not found<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 10pt; line-height: 115%; font-family: 'Courier New';"> </span></p>
<p class="MsoNormal"><span style="font-size: 10pt; line-height: 115%; font-family: 'Courier New';">So what's wrong here? Thanks in advance for any help.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size: 10pt; line-height: 115%; font-family: 'Courier New';">Kien Nguyen</span><span style="font-size:10.0pt;
line-height:115%;font-family:"Courier New""><o:p></o:p></span></p>
</div>
</body>
</html>