Do not check SEP bit for mirror zone trust anchors
When a mirror zone is verified, the 'ignore_kskflag' argument passed to dns_zoneverify_dnssec() is set to false. This means that in order for its verification to succeed, a mirror zone needs to have at least one key with the SEP bit set configured as a trust anchor. This brings no security benefit and prevents zones signed only using keys without the SEP bit set from being mirrored, so change the value of the 'ignore_kskflag' argument passed to dns_zoneverify_dnssec() to true.
Showing with 37 additions and 2 deletions