Skip to content

BIND
BIND
Open
Opened by Lefteris@Tsintjelis
Report abuse New issue

dnssec-keymgr needs clearer error for undefined policies

I am using FreeBSD 12 with bind binary port v9.11.8. v9.11.6P1 also had the same problem/bug(?).

I am using ECDSAP256SHA256 for ZSK and KSK. I have made a very simple policy that I am trying to automate by using dnssec-keymgr in crontab.

policy default {
        directory "/usr/local/etc/namedb/keys";
        algorithm ECDSAP256SHA256;
        pre-publish zsk 1w;
        post-publish zsk 1w;
        roll-period zsk 2mo;
};

zone example.com {
        policy default;
};

However, every time I run:

dnssec-keymgr -K /usr/local/etc/namedb/keys -r /dev/random

I always get this message:

Unable to apply policy: example.com/ECDSAP256SHA256: unsupported operand type(s) for +: 'float' and 'NoneType'

Edited by Evan Hunt

The one place for your designs

To enable design management, you'll need to meet the requirements. If you need help, reach out to our support team for assistance.