<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1258">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p></p>
<p data-start="49" data-end="83" class="">"Hi, I'm trying version 9.18.31.</p>
<p data-start="85" data-end="413" class="">According to the post on <a data-start="110" data-end="220" rel="noopener" target="_new" class="" href="https://kb.isc.org/docs/dnssec-key-and-signing-policy" id="LPlnk644488" previewremoved="true">
https://kb.isc.org/docs/dnssec-key-and-signing-policy</a>, the policy normally generates keys when they are needed. However, we can generate the DNSSEC keys ourselves first, and when the policy requires a new key, it will select the one we created.</p>
<p data-start="415" data-end="455" class="">There is even an example in that post.</p>
<p data-start="457" data-end="677" class="">So, I followed that approach. I generated a new key that matches the policy and placed it in the key directory. However, when it was time to roll the key, my key was retired, and the policy generated a new one instead.</p>
<p data-start="679" data-end="698" class="">Here is my policy:"</p>
<p></p>
<p><br>
</p>
<p></p>
<div>dnssec-policy "hosting key" {</div>
<div> dnskey-ttl PT1M;</div>
<div> keys{</div>
<div> ksk key-directory lifetime P1Y algorithm RSASHA256 2048;</div>
<div> zsk key-directory lifetime P30D algorithm RSASHA256 2048;</div>
<div> };</div>
<br>
<p></p>
<p>And i run this command to generate the next key:</p>
<p></p>
<div>dnssec-keygen -a 8 -b 2048 -n ZONE -K /data/keys/policy.com/ policy.com</div>
<div>i even tried </div>
<div>dnssec-keygen -k "hosting key" -l /etc/named.conf -K /data/keys/policy.com/ policy.com</div>
<div><br>
</div>
<div>so im pretty sure the new key matches the policy. But still, they all got retired.</div>
<div><br>
</div>
<div>Plz help.</div>
<div><br>
</div>
<div>Best regards,</div>
<div>Tam</div>
<br>
<p></p>
</div>
</body>
</html>