From: Daniel Salzman Date: Wed, 14 Feb 2024 14:51:54 +0000 (+0100) Subject: doc: update key rollover examples in operation X-Git-Tag: v3.4.0~174^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=990cbc86d9fcc86efda4795aef51f34a82c73ef8;p=thirdparty%2Fknot-dns.git doc: update key rollover examples in operation --- diff --git a/doc/operation.rst b/doc/operation.rst index 1f4ff06562..8c26629f08 100644 --- a/doc/operation.rst +++ b/doc/operation.rst @@ -583,8 +583,8 @@ Automatic KSK and ZSK rollovers example Let's start with the following set of keys:: - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active The last fields hint the key state: ``public`` denotes a key that will be presented as the DNSKEY record, ``ready`` means that CDS/CDNSKEY records were created, @@ -610,115 +610,121 @@ For demonstration purposes, the following configuration is used:: Upon the zone's KSK lifetime expiration, a new KSK is generated and the rollover continues along the lines of :rfc:`6781#section-4.1.2`:: - # KSK Rollover (50613 -> 9081) + # KSK Rollover (53594 -> 3375) - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, KSK rollover started - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active+ - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:50:00+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:50:12+0200 + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, KSK rollover started + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, next key action, KSK tag 3375, submit at 2024-02-14T15:20:12+0100 + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active+ + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111204, new RRSIGs 3 + 2024-02-14T15:20:00+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:20:12+0100 ... (propagation-delay + dnskey-ttl) ... - 2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:50:12+0200 notice: [example.com.] DNSSEC, KSK submission, waiting for confirmation - 2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, ready, active+ - 2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:50:12+0200 info: [example.com.] DNSSEC, next signing at 2021-05-17T20:49:56+0200 + 2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:20:12+0100 notice: [example.com.] DNSSEC, KSK submission, waiting for confirmation + 2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, ready, active+ + 2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111205, new RRSIGs 6 + 2024-02-14T15:20:12+0100 info: [example.com.] DNSSEC, next signing at 2024-02-28T15:19:37+0100 At this point the new KSK has to be submitted to the parent zone. Knot detects the updated parent's DS record automatically (and waits for additional period of the DS's TTL before retiring the old key) if :ref:`parent DS check` is configured, otherwise the operator must confirm it manually (using ``knotc zone-ksk-submitted``):: - 2021-05-10T20:50:12+0200 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300, KSK submission check: negative - 2021-05-10T20:50:14+0200 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300, KSK submission check: negative - 2021-05-10T20:50:16+0200 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300, KSK submission check: positive - 2021-05-10T20:50:16+0200 notice: [example.com.] DNSSEC, KSK submission, confirmed - 2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, key, tag 50613, algorithm ECDSAP256SHA256, KSK, public, active+ - 2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:50:16+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:50:23+0200 + 2024-02-14T15:20:12+0100 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300 TCP, KSK submission check: negative + 2024-02-14T15:20:14+0100 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300 TCP/pool, KSK submission check: negative + 2024-02-14T15:20:16+0100 info: [example.com.] DS check, outgoing, remote 127.0.0.1@5300 TCP/pool, KSK submission check: positive + 2024-02-14T15:20:16+0100 notice: [example.com.] DNSSEC, KSK submission, confirmed + 2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, key, tag 53594, algorithm ECDSAP256SHA256, KSK, public, active+ + 2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111206, new RRSIGs 2 + 2024-02-14T15:20:16+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:20:23+0100 ... (parent's DS TTL is 7 seconds) ... - 2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:50:23+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:51:56+0200 + 2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, next key action, ZSK, generate at 2024-02-14T15:21:54+0100 + 2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111207, new RRSIGs 2 + 2024-02-14T15:20:23+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:21:54+0100 Upon the zone's ZSK lifetime expiration, a new ZSK is generated and the rollover continues along the lines of :rfc:`6781#section-4.1.1`:: - # ZSK Rollover (62932 -> 33255) + # ZSK Rollover (36185 -> 38559) - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, ZSK rollover started - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:51:56+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:52:08+0200 + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, ZSK rollover started + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, next key action, ZSK tag 38559, replace at 2024-02-14T15:22:06+0100 + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111208, new RRSIGs 2 + 2024-02-14T15:21:54+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:22:06+0100 ... (propagation-delay + dnskey-ttl) ... - 2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, key, tag 62932, algorithm ECDSAP256SHA256, public - 2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:52:08+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:52:25+0200 + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, next key action, ZSK tag 36185, remove at 2024-02-14T15:22:23+0100 + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, key, tag 36185, algorithm ECDSAP256SHA256, public + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111209, new RRSIGs 14 + 2024-02-14T15:22:06+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:22:23+0100 ... (propagation-delay + zone-max-ttl) ... - 2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:52:25+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:54:08+0200 - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, next key action, ZSK, generate at 2024-02-14T15:24:06+0100 + 2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111210, new RRSIGs 2 + 2024-02-14T15:22:23+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:24:06+0100 Further rollovers:: ... (zsk-lifetime - propagation-delay - zone-max-ttl) ... - # Another ZSK Rollover (33255 -> 49526) + # Another ZSK Rollover (38559 -> 59825) - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, ZSK rollover started - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, key, tag 33255, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, key, tag 49526, algorithm ECDSAP256SHA256, public - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:54:08+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:54:20+0200 + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, ZSK rollover started + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, next key action, ZSK tag 59825, replace at 2024-02-14T15:24:18+0100 + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, key, tag 38559, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, key, tag 59825, algorithm ECDSAP256SHA256, public + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111211, new RRSIGs 2 + 2024-02-14T15:24:06+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:24:18+0100 ... - # Another KSK Rollover (9081 -> 9179) - - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, signing zone - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, KSK rollover started - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, key, tag 9081, algorithm ECDSAP256SHA256, KSK, public, active - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, key, tag 49526, algorithm ECDSAP256SHA256, public, active - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, key, tag 9179, algorithm ECDSAP256SHA256, KSK, public, active+ - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, signing started - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, successfully signed - 2021-05-10T20:55:00+0200 info: [example.com.] DNSSEC, next signing at 2021-05-10T20:55:12+0200 + # Another KSK Rollover (3375 -> 50822) + + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, signing zone + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, KSK rollover started + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, next key action, KSK tag 50822, submit at 2024-02-14T15:25:12+0100 + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, key, tag 3375, algorithm ECDSAP256SHA256, KSK, public, active + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, key, tag 59825, algorithm ECDSAP256SHA256, public, active + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, key, tag 50822, algorithm ECDSAP256SHA256, KSK, public, active+ + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, signing started + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, successfully signed, serial 2010111214, new RRSIGs 3 + 2024-02-14T15:25:00+0100 info: [example.com.] DNSSEC, next signing at 2024-02-14T15:25:12+0100 ...