Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have set up some domains with dnssec. I generated the keys and signed the zones with zonesigner from dnssec-tools. I know that I must resign the zones within 30 days. But what's up with the keys which I deposited at my domain provider? Do I need to renew the keys too? If yes, how? Can't find any information about this on the website.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

You are not required to renew the keys. Unlike RRSIG records, DNSSEC keys and corresponding DS signatures have no expiration date.

KSK (Key signing Keys):

You may choose to rotate keys from time to time, reasons to do so may be for example that possibly your keys stolen and you don't know. If your KSK is kept offline and thus unlikely to be compromised, there's no real need to rotate KSK.

ZSK (Zone signing Keys):

To rotate those you don't need your domain provider, thus it's much easier to rotate. Though if ZSKs are also kept secure enough, there's no real need to rotate them too.

The following RFC is the source of various DNSSEC-related recommendations:

RFC 4641 - DNSSEC Operational Practices, Version 2

.... a reasonable effectivity period for KSKs that have corresponding DS records in the parent zone is of the order of 2 decades or longer. That is, if one does not plan to test the rollover procedure, the key should be effective essentially forever, and only rolled over in case of emergency.

share|improve this answer
    
If I rotate the Key signing Keys will I get new DS signatures? –  user1091344 May 3 '12 at 8:34
    
you should send you new public Key Signing Keys to your domain provider, and they should create corresponding new DS records. –  Sandman4 May 3 '12 at 10:29
    
Massive thank you for this answer, it was very helpful. Wish I could give you more then just a +1 for the answer. –  Mark Tomlin Jan 30 '13 at 8:36

DNSSSEC has the concept of Zone Signing Keys which you would have on your noted 30 days ( with some overlap ). They keys you submitted to the registrar are called Key Signing Keys, and can have a different rotation schedule.

I think you could even create several ZSK's signed with your KSK, and then keep the KSK offline.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.