[Opendnssec-user] Key States after migrating from 1.4.10 to 2.1.0

[Sebastian Wiesinger]

Hello,

I just finished migrating from 1.4.10 to 2.1.0 and everything appears
to be running. The only thing I noticed is an extra KSK appearing:

***@alita:/etc/opendnssec# ods-enforcer rollover list -z dnssec-test.intern
Keys:
Zone: Keytype: Rollover expected:
dnssec-test.intern KSK No roll scheduled
dnssec-test.intern KSK No roll scheduled
dnssec-test.intern ZSK 2017-04-29 17:07:07
dnssec-test.intern ZSK 2017-04-29 17:07:07
***@alita:/etc/opendnssec# ods-enforcer key list -z dnssec-test.intern -d
Keys:
Zone: Key role: DS: DNSKEY: RRSIGDNSKEY: RRSIG: Pub: Act: Id:
dnssec-test.intern KSK rumoured omnipresent omnipresent NA 1 1 e79f3f37b8a9e76c6b63fd273daadb31
dnssec-test.intern KSK omnipresent omnipresent omnipresent NA 1 1 66c43087a1ae1989a17d2133de599e26
dnssec-test.intern ZSK NA omnipresent NA rumoured 1 1 29099c0d3024b7fa908cd27576aabd2d
dnssec-test.intern ZSK NA omnipresent NA unretentive 1 0 eb6252b8fb97e2c39f27514216cfb645

So I have an extra KSK in state rumoured with no key roll scheduled but active
in the zone. Is this to be expected?

Regards

Sebastian

[Yuri Schaeffer]

Post by Sebastian Wiesinger
So I have an extra KSK in state rumoured with no key roll scheduled but active
in the zone. Is this to be expected?

My guess is that your KASP states manual rollover for KSK. Therefore it
plans no future roll overs.

The extra key is then either because you gave a manual rollover command
or -this is likely the case- a standby key that your 1.4 installation
used. 2.x doesn't have/need the concept of standby keys, as it will be
able to roll to a new key /any/ time. Since it doesn't have this concept
it just 'rolls' with it.

I advice the execute a rollover command for that zone for KSK. The
current 2 keys will then be replaced by one new KSK. The extraneous KSK
should go away quite fast since it doesn't have its DS uploaded yet.

//Yuri