Re: [knot-dns-users] KSK and ZKS roll-overs on schedule

Hi Thomas, first of all, your requirements seem pretty weird. The key management in Knot mostly works "as needed", where precise scheduling is an unusual demand. However, with some computation, this can be achieved with automatic key management. For ZSKs, the period between two roll-overs is (zsk-lifetime + propagation-delay + dnskey-ttl). All these values can be configured in policy section so that the sum is your desired 24h. KSKs are more complicated, but their behavior is also different, thus the period between roll-overs is just ksk-lifetime. However, the roll-over procedure itself can take various time (including infinity), depending on key submission. For really predictible timings, you would need to substitute parent DS checks with simple timeout (in submission section, set timeout and unset parent), but take care of proper DS submission to avoid broken trust chain. Please also note that automatic key management performs only one key roll-over at a time. If KSK is still rolling, ZSK roll-over will be delayed (a vice versa). You need to somehow get to the state that ZSK expires e.g. on 12am and KSK on 6pm... The command `knotc zone-key-rollover` works with automatic key management, and invokes immediate (that is, earlier than configured lifetime) roll-over. So setting the lifetimes to infinity and reguralry initiating roll-overs this way is also possible. --- It's also possible to achieve the same with manual key management. With keymgr, you can generate keys and assign them timers. Each timer means, that the key shall enter the corresponding state at that time. 0 means infinity, or "never". The key states are described here https://www.knot-dns.cz/docs/2.9/singlehtml/index.html#dnssec-key-states and they are more-or-less equivalent to RFC 6781. After each change to any timers, don't forget to re-sign the zone with `knotc zone-sign`, so that the running server notices the change in key set. To get familiar with key timers, you might experiment with automatic key management and watch with `keymgr example.com. list` what the timers do. --- I don't really understand what you really mean with "I need to pre-generate the keys". Just an internal disclosure: the `knotc zone-key-rollover` command works the way that it only generates a key in "published" state and re-signs the zone. You might simulate this by importing pre-generated key with keymgr, setting only its "publish" timer to now. With automatic key management, normal roll-over will follow. However, this is a trick that we will probably not support forever. Hope this helps! Libor Dne 08.08.20 v 21:06 Thomas napsal(a):