Recompute check_ksk as it may have changed

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 1dc5a5fb2cf84789bcba5ca48c42cbd521323b19..2511d319b36e04e0d3155a98376a787e6acc84e5 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.511 2009/10/08 23:48:10 tbox Exp $ */
+/* $Id: zone.c,v 1.512 2009/10/08 23:55:57 marka Exp $ */
 
 /*! \file */
 
@@ -6515,6 +6515,13 @@ zone_sign(dns_zone_t *zone) {
                first = ISC_TRUE;
        }
 
+       /*
+        * Recompute check_ksk as it may have changed.
+        */
+       check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
+       if (check_ksk)
+               check_ksk = ksk_sanity(db, version);
+
        if (secureupdated) {
                /*
                 * We have changed the NSEC RRset above so we need to update