<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hi!!</p>
<p><br /></p>
<p>Thanks a lot for your answer!!</p>
<p><br /></p>
<p>I tried before the fact of renaming back and rndc sign... but does not work.... just has removed the error from the log....</p>
<p><br /></p>
<p>I have changed my key managing code, for not renaming to "-OLD" the ZSK (.key and .private) until have passed at least 2 days from the deletion time... Let's see if this way works better....</p>
<div> </div>
<p><br /></p>
<p>Any more ideas mates?.</p>
<p><br /></p>
<p>Thank you so much for your time :)</p>
<p><br /></p>
<p>Best regards,</p>
<p>El 2022-01-24 17:51, Tony Finch escribió:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">ATENCION<br /> ATENCION<br /> ATENCION!!! Este correo se ha enviado desde fuera de la organizacion. No pinche en los enlaces ni abra los adjuntos a no ser que reconozca el remitente y sepa que el contenido es seguro.<br /> <br /> egoitz--- via bind-users <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>> wrote:
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><br /> These are the contents of a cat of the private file I have renamed to<br /> samename.private-OLD :<br /> <br /> Created: 20211031230338<br /> Publish: 20211110220241<br /> Activate: 20211110220341<br /> Inactive: 20211215230338<br /> Delete: 20211217230338</blockquote>
<br /> Yes, it can be confusing when the state of the key files doesn't match the<br /> state of the zone.<br /> <br /> I think you said you have renamed all your key files back to their usual<br /> non-OLD names. Good; that is necessary if named is still looking for a key<br /> file even if it shouldn't need it any more.<br /> <br /> Then, try running `rndc sign <zone>`, to make named reload the keys. I<br /> think that should also get it to make whatever updates might be necessary.<br /> <br /> Then look at the logs to see if there are errors, and look at the DNSKEY<br /> RRset (with its RRSIGs) to make sure it matches what you expect.<br /> <br /> If that doesn't get things straightened out then, um, dunno :-)<br /> <br /> I guess it is possible to get into a muddle if you try to move a key out<br /> of the way very soon after its delete time. By default, named does key<br /> maintenance infrequently, so I guess if you move the key after its<br /> deletion time but before the next key maintenance cycle, things will get<br /> out of sync. But I have not checked whether my guess is right or not.<br /> <br /> Tony.</div>
</blockquote>
</body></html>