mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 22:45:39 +00:00
Code Issues Releases Wiki Activity

Fix ZSK lifetime minimum constraints documentation

Browse Source 
The ARM failed to mention that the ZSK lifetime minimum also depends
on the signing delay.
This commit is contained in:
Matthijs Mekking
2024-01-04 10:27:26 +01:00
parent c92b6fc5b0
commit 53f0541db6
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
doc/arm/reference.rst
View File

@@ -6332,10 +6332,11 @@ The following options can be specified in a :any:`dnssec-policy` statement:
must be more than the publication interval (which is the sum of
:any:`dnskey-ttl`, :any:`publish-safety`, and :any:`zone-propagation-delay`).
It must also be more than the retire interval (which is the sum of
:any:`max-zone-ttl`, :any:`retire-safety` and :any:`zone-propagation-delay`
for ZSKs, and the sum of :any:`parent-ds-ttl`, :any:`retire-safety`, and
:any:`parent-propagation-delay` for KSKs and CSKs). BIND 9 treats a key
lifetime that is too short as an error.
:any:`max-zone-ttl`, :any:`retire-safety`, :any:`zone-propagation-delay`,
and signing delay (:any:`signatures-validity` minus
:any:`signatures-refresh`) for ZSKs, and the sum of :any:`parent-ds-ttl`,
:any:`retire-safety`, and :any:`parent-propagation-delay` for KSKs and
CSKs). BIND 9 treats a key lifetime that is too short as an error.
The ``algorithm`` parameter specifies the key's algorithm, expressed
either as a string ("rsasha256", "ecdsa384", etc.) or as a decimal