[Opendnssec-user] DNSKEY record set not published in a new zone

[Stephane Bortzmeyer]

I just added a new zone to an OpenDNSSEC installation which works for
several other zones.

I tried adding the new zone bot with zonelist.xml + ods-enforcer zone
import, and with ods-enforcer zone add. Same result in both cases.

The KSK stays in state "generate" (why?):

% sudo ods-enforcer key list --keystate generate --zone foo.example

Keys:
Zone: Keytype: State: Date of next transition:
foo.example KSK generate 2018-11-12 06:46:20
key list completed in 0 seconds.

The ZSK is in state publish:

% sudo ods-enforcer key list --zone foo.example

Keys:
Zone: Keytype: State: Date of next transition:
foo.example ZSK publish 2018-11-12 06:46:20
key list completed in 0 seconds.

But no DNSKEY at all is added in the signed zone. (There are RRSIGs,
and NSEC3.)

OpenDNSSEC 2.0.4

(Side note: when NSD loads a zone with no DNSKEY, it doesn't serve the
signatures at all.)

Key policy is:

<Keys>
<TTL>PT7200S</TTL>
<RetireSafety>PT7200S</RetireSafety>
<PublishSafety>PT7200S</PublishSafety>
<Purge>P14D</Purge>
<KSK>
<Algorithm length="2048">8</Algorithm>
<Lifetime>P3Y</Lifetime>
<Repository>SoftHSM</Repository>
<ManualRollover/>
</KSK>
<ZSK>
<Algorithm length="1024">8</Algorithm>
<Lifetime>P90D</Lifetime>
<Repository>SoftHSM</Repository>
</ZSK>
</Keys>

[Stephane Bortzmeyer]

On Sat, Nov 10, 2018 at 07:00:35PM +0100,

Post by Stephane Bortzmeyer
But no DNSKEY at all is added in the signed zone. (There are RRSIGs,
and NSEC3.)

When the KSK moved to the state Ready, the keys were published. It
seems abnormal.