3110. [bug] dnssec-signzone: Wrong error message could appear

			when attempting to sign with no KSK. [RT #24369]

diff --git a/CHANGES b/CHANGES
index 06f755163748cf68a22b8ed10742adb99c4c9deb..e472d096bf9c9ad883ab4d5ac38b4e4e9916a6d1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3110.  [bug]           dnssec-signzone: Wrong error message could appear
+                       when attempting to sign with no KSK. [RT #24369]
+
 3109.  [func]          The also-notify option now uses the same syntax
                        as a zone's masters clause.  This means it is
                        now possible to specify a TSIG key to use when

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 1fdb4becf4596fb45de8c7457ef7aad7bd93ea1c..a639c729416337eedf049ce9af2769c390bde226 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.275 2011/05/06 21:08:33 each Exp $ */
+/* $Id: dnssec-signzone.c,v 1.276 2011/05/07 00:31:13 each Exp $ */
 
 /*! \file */
 
@@ -3906,6 +3906,8 @@ main(int argc, char *argv[]) {
                nokeys = ISC_TRUE;
        }
 
+       warnifallksk(gdb);
+
        if (IS_NSEC3) {
                unsigned int max;
                result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
@@ -3915,8 +3917,6 @@ main(int argc, char *argv[]) {
                              "strength. Maximum iterations allowed %u.", max);
        }
 
-       warnifallksk(gdb);
-
        gversion = NULL;
        result = dns_db_newversion(gdb, &gversion);
        check_result(result, "dns_db_newversion()");