mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-04 17:24:47 -04:00
bbfdcc36c8
Add an option to enable/disable inline-signing inside the
dnssec-policy clause. The existing inline-signing option that is
set in the zone clause takes priority, but if it is omitted, then the
value that is set in dnssec-policy is taken.
The built-in policies use inline-signing.
This means that if you want to use the default policy without
inline-signing you either have to set it explicitly in the zone
clause:
zone "example" {
...
dnssec-policy default;
inline-signing no;
};
Or create a new policy, only overriding the inline-signing option:
dnssec-policy "default-dynamic" {
inline-signing no;
};
zone "example" {
...
dnssec-policy default-dynamic;
};
This also means that if you are going insecure with a dynamic zone,
the built-in "insecure" policy needs to be accompanied with
"inline-signing no;".
|
||
|---|---|---|
| .. | ||
| ans4 | ||
| CA | ||
| krb | ||
| ns1 | ||
| ns2 | ||
| ns3 | ||
| ns5 | ||
| ns6 | ||
| ns7 | ||
| ns8 | ||
| ns9 | ||
| ns10 | ||
| .gitignore | ||
| clean.sh | ||
| commandlist | ||
| dhparam3072.pem | ||
| knowngood.ns1.after | ||
| knowngood.ns1.afterstop | ||
| knowngood.ns1.before | ||
| resolv.conf | ||
| setup.sh | ||
| tests.sh | ||
| tests_sh_nsupdate.py | ||
| update_test.pl | ||
| verylarge.in | ||