[Opendnssec-user] single KSK, multiple ZSKs

[Simon Fromme]

Hello,

I am currently trying to set up OpenDNSSEC 2.0.1 wanting to use a single
KSK to sign the ZSKs of multiple zones.

Having not found any information on
https://wiki.opendnssec.org/display/DOCS20/OpenDNSSEC, I'd be glad if
somebody could provide me with a way to do this. Each zone file should
be signed with its own ZSK, yet all ZSKs should be signed by a single
KSK. What configuration steps are necessary to prevent OpenDNSSEC from
generating an entirely new ZSK/KSK key-pair each time?

The possibility to do so seems to be a new feature of the recent 2.0
version so looking at the older (but much more detailed) documentation
did not help.

Thanks a lot!
Simon

[Yuri Schaeffer]

Hi Simon,

Post by Simon Fromme
Each zone file should
be signed with its own ZSK, yet all ZSKs should be signed by a single
KSK. What configuration steps are necessary to prevent OpenDNSSEC from
generating an entirely new ZSK/KSK key-pair each time?

There is the <ShareKeys/> element in the <Keys> section as was there in
ODS 1.4. And it behaves mostly the same: both KSK ans ZSK will be
shared. So it does not match your requirements.

If you don't mind me asking, what are your motivations for not sharing
ZSKs as well?

Regards,
Yuri