From: Mark Karpilovskij <mark.karpilovskij@nic.cz>
Date: Mon, 5 Nov 2018 13:44:46 +0000 (+0100)
Subject: doc: a note about switching from manual to auto key management
X-Git-Tag: v2.8.0~184
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4b81a6d6a0c5308fcda7ebfcdfd77f4f5624b463;p=thirdparty%2Fknot-dns.git

doc: a note about switching from manual to auto key management
---

diff --git a/doc/configuration.rst b/doc/configuration.rst
index 98323f636b..8a3d77f4cf 100644
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -488,6 +488,22 @@ activated.  A few moments later, the old key will be deactivated and removed.
 You can use exact time specification to make these two actions happen in one
 go.
 
+.. WARNING::
+   If you ever decide to switch from manual key management to automatic key management
+   while the server is running, note that the automatic key management uses
+   :ref:`policy_zsk-lifetime` and :ref:`policy_ksk-lifetime` policy configuration
+   options to schedule key rollovers and it internally uses timestamps of keys differently
+   than in the manual case. As a consequence it might break if the ``retire`` or ``remove`` timestamps
+   are set for the manually generated keys currently in use. Make sure to set these timestamps
+   to zero using :doc:`keymgr <man_keymgr>`:
+
+   .. code-block:: console
+
+       $ keymgr myzone.test. set <key_id> retire=0 remove=0
+
+   and configure your policy suitably according to :ref:`dnssec-automatic-zsk-management`
+   and :ref:`dnssec-automatic-ksk-management`.
+
 .. _dnssec-signing:
 
 Zone signing