தொகுதி பாடங்கள் (2/3)
KSK, ZSK e rollover
KSK, ZSK, and rollover
Some operations distinguish a key-signing key (KSK), which signs DNSKEY data, from a zone-signing key (ZSK), which signs other RRsets. Implementations and key-management models vary; understand the configuration in use rather than assuming every operator uses the same split.
A rollover is a distributed transition. Resolvers and parent zones may hold data in caches for different periods. The usual safe pattern is to publish and verify the new key, keep old and new material available through the required overlap, update the parent DS when appropriate, and remove the old key only after the transition is known to be complete.
Plan the sequence, prerequisites, observation points, and rollback before changing production keys. Never expose private key material to make a rollover easier.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
Why are old and new keys often published together during rollover?