upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Add new behavior to the ARM

Browse source 
Add text to the ARM that describes what we do in case key files have
become unavailable.

(cherry picked from commit 351c066d91)
This commit is contained in:
Matthijs Mekking 2024-10-11 14:38:55 +02:00
parent 39e4576341
commit 16fed98e20
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
doc/arm/reference.rst
View file

@ -6418,6 +6418,14 @@ zone is generated even if they have the same policy. If multiple views
are configured with different versions of the same zone, each separate
version uses the same set of signing keys.
If the expected key files that were previously observed have gone missing or
are inaccessible, key management is halted. This will prevent rollovers
from being started if there is a temporary file access issue. If his problem
is permanent it will eventually lead to expired signatures in your zone.
Note that if the key files are missing or inaccessible during :iscman:`named`
startup, BIND 9 will try to generate new keys according to the DNSSEC policy,
because it has no cached information about existing keys yet.
The :any:`dnssec-policy` statement requires dynamic DNS to be set up, or
:any:`inline-signing` to be enabled.