Could anybody provide a step-by-step procedure to set up DNSSEC under BIND 9.7? I think the version is relevant because it is supposed to make life easier. In fact, there is a document published by ISC called DNSSEC for Humans, which I used as a starting point, though it's not quite a tutorial.
The main reason I'm using 9.7 (say, instead of the brand new 9.9) is that it is the stable version under Debian 6. I should mention that I have a basic BIND configuration up and running.
What I tried:
Included inside the appropriate curly brackets in
and restarted BIND.
dnssec-keygen -fk example.com
dnssec-signzone –S example.com
However, the last step gives me the error
dnssec-signzone: fatal: No signing keys specified or found.
I can see this is a likely error, as there seem to be missing options indicating where my keys are, but on the hand the referred guide by ISC cites specifically this last example. Indeed, the flag -S stands in fact for "smart signing", so I was hoping having the keys in the same directory from where I execute the last command (
/etc/bind) could suffice.
Since this is a toy, non-production project, I don't mind repeating these steps, say, every 30 days, but I'd like to keep them as simple as possible and... get them right!
Any ideas/pointers? Thanks in advance.