<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 14/02/23 05:39, adrien sipasseuth
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CABOLApy+SMkMU6Cc5j+p=pobbgyk=K+j8xD6ty6CNN5-5bp+pQ@mail.gmail.com">"You
configure parental agents and named will check which DS’s are
published. Named won’t complete the<br>
<div>
roll until it knows the new DS is published."</div>
<div>=> what is parental agent ? i don't find this term in Bind
documentation. From what I understand, you have to specify to
Bind that the new DS is published with the command: rndc dnssec
-checkds -key <id new ksk> published <my-zone></div>
</blockquote>
Have a look at
<a class="moz-txt-link-freetext" href="https://downloads.isc.org/isc/bind9/9.18.11/doc/arm/html/reference.html">https://downloads.isc.org/isc/bind9/9.18.11/doc/arm/html/reference.html</a>
and search for "<code class="docutils literal notranslate"><span
class="pre">parental-agents</span></code>"? (The basic idea is
that BIND will automatically poll to see if the new DS has been
published, rather than relying on you to run the rndc command.)<br>
<blockquote type="cite"
cite="mid:CABOLApy+SMkMU6Cc5j+p=pobbgyk=K+j8xD6ty6CNN5-5bp+pQ@mail.gmail.com">
<div><br>
</div>
<div>"If it was me, I'd set the KSK to not roll-over
automatically, and <br>
instead create a recurring reminder for yourself to initiate the
KSK <br>
roll-over manually? That way you'd never get caught out with a
KSK <br>
roll-over happening when you weren't prepared for it?
"<br>
</div>
<div>=> I don't know if I can get a policy for ZSK and a manual
method for KSK. From what I understand if I want to use a policy
I have to remove "auto-dnssec maintain;" which is necessary for
the manual method right?</div>
</blockquote>
<p>You can configure your dnssec-policy to automatically roll the
ZSK only, and then you can manually roll the KSK. Just set the
policy to give the KSK an unlimited lifetime, e.g.:<br>
</p>
<p>dnssec-policy 90dayzsk {<br>
keys {<br>
ksk lifetime unlimited algorithm ecdsa256;<br>
zsk lifetime P90D algorithm ecdsa256;<br>
};<br>
};</p>
<p>You can trigger the (KSK) roll-over with: rndc dnssec -rollover
-key xxx</p>
<p>BIND will then schedule the creation of the new key, etc, and all
you need to do is change the DS key (in the parent zone) at the
appropriate time, then (if not using parental-agents) tell BIND
that you've done it, and it will take care of retiring the old
key.<br>
</p>
<blockquote type="cite"
cite="mid:CABOLApy+SMkMU6Cc5j+p=pobbgyk=K+j8xD6ty6CNN5-5bp+pQ@mail.gmail.com">
<div><br>
</div>
<div>In the meantime, I wonder if I can't stay on the manual
method even with a bind 9.18? I read that the auto-dnssec
directive might disappear in favor of dnssec-policy. Does that
mean that it might not be possible to do it manually anymore?
source here => <a
href="https://kb.isc.org/v1/docs/dnssec-key-and-signing-policy"
moz-do-not-send="true" class="moz-txt-link-freetext">https://kb.isc.org/v1/docs/dnssec-key-and-signing-policy</a><br>
</div>
</blockquote>
See previous answer. IMHO transitioning to using dnssec-policy is
definitely worth it! :-)<br>
</body>
</html>