upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-10 05:50:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[9.20] chg: doc: Clarify rndc sign

Browse source 
It was not explicitly clear that ``rndc sign`` replaces signatures of inactive keys and updates signatures that are not so fresh.

Closes #5490

Backport of MR !11396

Merge branch 'backport-5490-clear-rndc-sign-on-error-9.20' into 'bind-9.20'

See merge request isc-projects/bind9!11409
This commit is contained in:
Matthijs Mekking 2025-12-22 15:12:49 +00:00
commit 6f2fe873be
1 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
bin/rndc/rndc.rst
View file

@ -277,9 +277,7 @@ Currently supported commands are:
immediately re-signed by the new keys, but is allowed to
incrementally re-sign over time.
This command requires that the zone be configured with a ``dnssec-policy``, and
also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
Update Policies" in the Administrator Reference Manual for more details.)
This command requires that the zone be configured with a ``dnssec-policy``.
.. option:: managed-keys (status | refresh | sync | destroy) [class [view]]
@ -549,11 +547,11 @@ Currently supported commands are:
the ``key-directory`` option in the BIND 9 Administrator Reference
Manual). If they are within their publication period, they are merged into
the zone's DNSKEY RRset. If the DNSKEY RRset is changed, then the
zone is automatically re-signed with the new key set.
zone is automatically re-signed with the new key set. This will replace signatures
of inactive keys with signatures from active keys, and update signatures that
expire within the refresh interval.
This command requires that the zone be configured with a ``dnssec-policy``, and
also requires the zone to be configured to allow dynamic DNS. (See "Dynamic
Update Policies" in the Administrator Reference Manual for more details.)
This command requires that the zone be configured with a ``dnssec-policy``.
See also :option:`rndc loadkeys`.