[9.20] chg: usr: dnssec-ksr now supports KSK rollovers (!9711) · Merge requests · ISC Open Source Projects / BIND

bind-team-rw-api-rw-repo requested to merge backport-4705-dnssec-ksr-only-sign-with-active-ksks-9.20 into bind-9.20 Nov 01, 2024

The tool 'dnssec-ksr' now allows for KSK generation, as well as planned KSK rollovers. When signing a bundle from a Key Signing Request (KSR), only the key that is active in that time frame is being used for signing. Also, the CDS and CDNSKEY records are now added and removed at the correct time.

Closes #4697 (closed)

Closes #4705 (closed)

Backport of MR !9452 (merged)

[9.20] chg: usr: dnssec-ksr now supports KSK rollovers

Merge request reports