setup.sh revision 1.1
1 #!/bin/sh -e 2 # 3 # Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4 # 5 # This Source Code Form is subject to the terms of the Mozilla Public 6 # License, v. 2.0. If a copy of the MPL was not distributed with this 7 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 8 # 9 # See the COPYRIGHT file distributed with this work for additional 10 # information regarding copyright ownership. 11 12 # shellcheck source=conf.sh 13 . "$SYSTEMTESTTOP/conf.sh" 14 15 echo_i "ns6/setup.sh" 16 17 setup() { 18 zone="$1" 19 echo_i "setting up zone: $zone" 20 zonefile="${zone}.db" 21 infile="${zone}.db.infile" 22 echo "$zone" >> zones.2 23 } 24 25 private_type_record() { 26 _zone=$1 27 _algorithm=$2 28 _keyfile=$3 29 30 _id=$(keyfile_to_key_id "$_keyfile") 31 32 printf "%s. 0 IN TYPE65534 %s 5 %02x%04x0000\n" "$_zone" "\\#" "$_algorithm" "$_id" 33 } 34 35 36 # Make lines shorter by storing key states in environment variables. 37 H="HIDDEN" 38 R="RUMOURED" 39 O="OMNIPRESENT" 40 U="UNRETENTIVE" 41 42 # Set up a zone with auto-dnssec maintain to migrate to dnssec-policy. 43 setup migrate.kasp 44 echo "$zone" >> zones 45 KSK=$($KEYGEN -a ECDSAP256SHA256 -f KSK -L 7200 $zone 2> keygen.out.$zone.1) 46 ZSK=$($KEYGEN -a ECDSAP256SHA256 -L 7200 $zone 2> keygen.out.$zone.2) 47 $SETTIME -P now -P sync now -A now "$KSK" > settime.out.$zone.1 2>&1 48 $SETTIME -P now -A now "$ZSK" > settime.out.$zone.2 2>&1 49 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile" 50 private_type_record $zone 5 "$KSK" >> "$infile" 51 private_type_record $zone 5 "$ZSK" >> "$infile" 52 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 53 54 # Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this 55 # time the existing keys do not match the policy. The existing keys are 56 # RSASHA1 keys, and will be migrated to a dnssec-policy that dictates 57 # ECDSAP256SHA256 keys. 58 setup migrate-nomatch-algnum.kasp 59 echo "$zone" >> zones 60 KSK=$($KEYGEN -a RSASHA1 -b 2048 -f KSK -L 300 $zone 2> keygen.out.$zone.1) 61 ZSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300 $zone 2> keygen.out.$zone.2) 62 Tds="now-24h" # Time according to dnssec-policy that DS will be OMNIPRESENT 63 Tkey="now-3900s" # DNSKEY TTL + propagation delay 64 Tsig="now-12h" # Zone's maximum TTL + propagation delay 65 $SETTIME -P $Tkey -P sync $Tds -A $Tkey "$KSK" > settime.out.$zone.1 2>&1 66 $SETTIME -P $Tsig -A $Tsig "$ZSK" > settime.out.$zone.2 2>&1 67 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile" 68 private_type_record $zone 5 "$KSK" >> "$infile" 69 private_type_record $zone 5 "$ZSK" >> "$infile" 70 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 71 72 # Set up a zone with auto-dnssec maintain to migrate to dnssec-policy, but this 73 # time the existing keys do not match the policy. The existing keys are 74 # 1024 bits RSASHA1 keys, and will be migrated to a dnssec-policy that 75 # dictates 2048 bits RSASHA1 keys. 76 setup migrate-nomatch-alglen.kasp 77 echo "$zone" >> zones 78 KSK=$($KEYGEN -a RSASHA1 -b 1024 -f KSK -L 300 $zone 2> keygen.out.$zone.1) 79 ZSK=$($KEYGEN -a RSASHA1 -b 1024 -L 300 $zone 2> keygen.out.$zone.2) 80 Tds="now-24h" # Time according to dnssec-policy that DS will be OMNIPRESENT 81 Tkey="now-3900s" # DNSKEY TTL + propagation delay 82 Tsig="now-12h" # Zone's maximum TTL + propagation delay 83 $SETTIME -P $Tkey -P sync $Tds -A $Tkey "$KSK" > settime.out.$zone.1 2>&1 84 $SETTIME -P $Tsig -A $Tsig "$ZSK" > settime.out.$zone.2 2>&1 85 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile" 86 private_type_record $zone 5 "$KSK" >> "$infile" 87 private_type_record $zone 5 "$ZSK" >> "$infile" 88 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 89 90 # 91 # The zones at algorithm-roll.kasp represent the various steps of a ZSK/KSK 92 # algorithm rollover. 93 # 94 95 # Step 1: 96 # Introduce the first key. This will immediately be active. 97 setup step1.algorithm-roll.kasp 98 echo "$zone" >> zones 99 KSK=$($KEYGEN -a RSASHA1 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 100 ZSK=$($KEYGEN -a RSASHA1 -L 3600 $zone 2> keygen.out.$zone.2) 101 TactN="now" 102 $SETTIME -s -P $TactN -A $TactN -g $O -k $O $TactN -r $O $TactN -d $O $TactN "$KSK" > settime.out.$zone.1 2>&1 103 $SETTIME -s -P $TactN -A $TactN -g $O -k $O $TactN -z $O $TactN "$ZSK" > settime.out.$zone.2 2>&1 104 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile" 105 private_type_record $zone 5 "$KSK" >> "$infile" 106 private_type_record $zone 5 "$ZSK" >> "$infile" 107 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 108 109 # Step 2: 110 # After the publication interval has passed the DNSKEY is OMNIPRESENT. 111 setup step2.algorithm-roll.kasp 112 KSK1=$($KEYGEN -a RSASHA1 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 113 ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zone 2> keygen.out.$zone.2) 114 KSK2=$($KEYGEN -a ECDSAP256SHA256 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 115 ZSK2=$($KEYGEN -a ECDSAP256SHA256 -L 3600 $zone 2> keygen.out.$zone.2) 116 # The time passed since the new algorithm keys have been introduced is 3 hours. 117 TactN="now-3h" 118 TpubN1="now-3h" 119 TactN1="now+6h" 120 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -r $O $TactN -d $O $TactN "$KSK1" > settime.out.$zone.1 2>&1 121 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -z $O $TactN "$ZSK1" > settime.out.$zone.2 2>&1 122 $SETTIME -s -P $TpubN1 -A $TpubN1 -g $O -k $R $TpubN1 -r $R $TpubN1 -d $H $TpubN1 "$KSK2" > settime.out.$zone.1 2>&1 123 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $R $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.out.$zone.2 2>&1 124 # Fake lifetime of old algorithm keys. 125 echo "Lifetime: 0" >> "${KSK1}.state" 126 echo "Lifetime: 0" >> "${ZSK1}.state" 127 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile" 128 private_type_record $zone 5 "$KSK1" >> "$infile" 129 private_type_record $zone 5 "$ZSK1" >> "$infile" 130 private_type_record $zone 13 "$KSK2" >> "$infile" 131 private_type_record $zone 13 "$ZSK2" >> "$infile" 132 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 133 134 # Step 3: 135 # The zone signatures are also OMNIPRESENT. 136 setup step3.algorithm-roll.kasp 137 KSK1=$($KEYGEN -a RSASHA1 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 138 ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zone 2> keygen.out.$zone.2) 139 KSK2=$($KEYGEN -a ECDSAP256SHA256 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 140 ZSK2=$($KEYGEN -a ECDSAP256SHA256 -L 3600 $zone 2> keygen.out.$zone.2) 141 # The time passed since the new algorithm keys have been introduced is 9 hours. 142 TactN="now-9h" 143 TpubN1="now-9h" 144 TactN1="now" 145 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -r $O $TactN -d $O $TactN "$KSK1" > settime.out.$zone.1 2>&1 146 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -z $O $TactN "$ZSK1" > settime.out.$zone.2 2>&1 147 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -r $O $TpubN1 -d $H $TpubN1 "$KSK2" > settime.out.$zone.1 2>&1 148 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.out.$zone.2 2>&1 149 # Fake lifetime of old algorithm keys. 150 echo "Lifetime: 0" >> "${KSK1}.state" 151 echo "Lifetime: 0" >> "${ZSK1}.state" 152 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile" 153 private_type_record $zone 5 "$KSK1" >> "$infile" 154 private_type_record $zone 5 "$ZSK1" >> "$infile" 155 private_type_record $zone 13 "$KSK2" >> "$infile" 156 private_type_record $zone 13 "$ZSK2" >> "$infile" 157 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 158 159 # Step 4: 160 # The DS is swapped and can become OMNIPRESENT. 161 setup step4.algorithm-roll.kasp 162 KSK1=$($KEYGEN -a RSASHA1 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 163 ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zone 2> keygen.out.$zone.2) 164 KSK2=$($KEYGEN -a ECDSAP256SHA256 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 165 ZSK2=$($KEYGEN -a ECDSAP256SHA256 -L 3600 $zone 2> keygen.out.$zone.2) 166 # The time passed since the DS has been swapped is 29 hours. 167 TactN="now-38h" 168 TpubN1="now-38h" 169 TactN1="now-29h" 170 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -r $O $TactN -d $U $TactN1 "$KSK1" > settime.out.$zone.1 2>&1 171 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -z $O $TactN "$ZSK1" > settime.out.$zone.2 2>&1 172 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -r $O $TpubN1 -d $R $TactN1 "$KSK2" > settime.out.$zone.1 2>&1 173 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.out.$zone.2 2>&1 174 # Fake lifetime of old algorithm keys. 175 echo "Lifetime: 0" >> "${KSK1}.state" 176 echo "Lifetime: 0" >> "${ZSK1}.state" 177 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile" 178 private_type_record $zone 5 "$KSK1" >> "$infile" 179 private_type_record $zone 5 "$ZSK1" >> "$infile" 180 private_type_record $zone 13 "$KSK2" >> "$infile" 181 private_type_record $zone 13 "$ZSK2" >> "$infile" 182 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 183 184 # Step 5: 185 # The DNSKEY is removed long enough to be HIDDEN. 186 setup step5.algorithm-roll.kasp 187 KSK1=$($KEYGEN -a RSASHA1 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 188 ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zone 2> keygen.out.$zone.2) 189 KSK2=$($KEYGEN -a ECDSAP256SHA256 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 190 ZSK2=$($KEYGEN -a ECDSAP256SHA256 -L 3600 $zone 2> keygen.out.$zone.2) 191 # The time passed since the DNSKEY has been removed is 2 hours. 192 TactN="now-40h" 193 TpubN1="now-40h" 194 TactN1="now-31h" 195 TremN="now-2h" 196 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $U $TremN -r $U $TremN -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1 197 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $U $TremN -z $U $TremN "$ZSK1" > settime.out.$zone.2 2>&1 198 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -r $O $TpubN1 -d $O $TactN1 "$KSK2" > settime.out.$zone.1 2>&1 199 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.out.$zone.2 2>&1 200 # Fake lifetime of old algorithm keys. 201 echo "Lifetime: 0" >> "${KSK1}.state" 202 echo "Lifetime: 0" >> "${ZSK1}.state" 203 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile" 204 private_type_record $zone 5 "$KSK1" >> "$infile" 205 private_type_record $zone 5 "$ZSK1" >> "$infile" 206 private_type_record $zone 13 "$KSK2" >> "$infile" 207 private_type_record $zone 13 "$ZSK2" >> "$infile" 208 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 209 210 # Step 6: 211 # The RRSIGs have been removed long enough to be HIDDEN. 212 setup step6.algorithm-roll.kasp 213 KSK1=$($KEYGEN -a RSASHA1 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 214 ZSK1=$($KEYGEN -a RSASHA1 -L 3600 $zone 2> keygen.out.$zone.2) 215 KSK2=$($KEYGEN -a ECDSAP256SHA256 -f KSK -L 3600 $zone 2> keygen.out.$zone.1) 216 ZSK2=$($KEYGEN -a ECDSAP256SHA256 -L 3600 $zone 2> keygen.out.$zone.2) 217 # Additional time passed: 7h. 218 TactN="now-47h" 219 TpubN1="now-47h" 220 TactN1="now-38h" 221 TdeaN="now-9h" 222 TremN="now-7h" 223 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $H $TremN -r $U $TdeaN -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1 224 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $H $TremN -z $U $TdeaN "$ZSK1" > settime.out.$zone.2 2>&1 225 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -r $O $TpubN1 -d $O $TactN1 "$KSK2" > settime.out.$zone.1 2>&1 226 $SETTIME -s -P $TpubN1 -A $TactN1 -g $O -k $O $TpubN1 -z $R $TpubN1 "$ZSK2" > settime.out.$zone.2 2>&1 227 # Fake lifetime of old algorithm keys. 228 echo "Lifetime: 0" >> "${KSK1}.state" 229 echo "Lifetime: 0" >> "${ZSK1}.state" 230 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile" 231 private_type_record $zone 5 "$KSK1" >> "$infile" 232 private_type_record $zone 5 "$ZSK1" >> "$infile" 233 private_type_record $zone 13 "$KSK2" >> "$infile" 234 private_type_record $zone 13 "$ZSK2" >> "$infile" 235 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 236 237 # 238 # The zones at csk-algorithm-roll.kasp represent the various steps of a CSK 239 # algorithm rollover. 240 # 241 242 # Step 1: 243 # Introduce the first key. This will immediately be active. 244 setup step1.csk-algorithm-roll.kasp 245 echo "$zone" >> zones 246 CSK=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $zone 2> keygen.out.$zone.1) 247 TactN="now" 248 $SETTIME -s -P $TactN -A $TactN -g $O -k $O $TactN -r $O $TactN -z $O $TactN -d $O $TactN "$CSK" > settime.out.$zone.1 2>&1 249 cat template.db.in "${CSK}.key" > "$infile" 250 private_type_record $zone 5 "$CSK" >> "$infile" 251 $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 252 253 # Step 2: 254 # After the publication interval has passed the DNSKEY is OMNIPRESENT. 255 setup step2.csk-algorithm-roll.kasp 256 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $zone 2> keygen.out.$zone.1) 257 CSK2=$($KEYGEN -k csk-algoroll -l policies/csk2.conf $zone 2> keygen.out.$zone.1) 258 # The time passed since the new algorithm keys have been introduced is 3 hours. 259 TactN="now-3h" 260 TpubN1="now-3h" 261 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -r $O $TactN -z $O $TactN -d $O $TactN "$CSK1" > settime.out.$zone.1 2>&1 262 $SETTIME -s -P $TpubN1 -A $TpubN1 -g $O -k $R $TpubN1 -r $R $TpubN1 -z $R $TpubN1 -d $H $TpubN1 "$CSK2" > settime.out.$zone.1 2>&1 263 # Fake lifetime of old algorithm keys. 264 echo "Lifetime: 0" >> "${CSK1}.state" 265 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile" 266 private_type_record $zone 5 "$CSK1" >> "$infile" 267 private_type_record $zone 13 "$CSK2" >> "$infile" 268 $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 269 270 # Step 3: 271 # The zone signatures are also OMNIPRESENT. 272 setup step3.csk-algorithm-roll.kasp 273 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $zone 2> keygen.out.$zone.1) 274 CSK2=$($KEYGEN -k csk-algoroll -l policies/csk2.conf $zone 2> keygen.out.$zone.1) 275 # The time passed since the new algorithm keys have been introduced is 9 hours. 276 TactN="now-9h" 277 TpubN1="now-9h" 278 TactN1="now-6h" 279 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -r $O $TactN -z $O $TactN -d $O $TactN "$CSK1" > settime.out.$zone.1 2>&1 280 $SETTIME -s -P $TpubN1 -A $TpubN1 -g $O -k $O $TactN1 -r $O $TactN1 -z $R $TpubN1 -d $H $TpubN1 "$CSK2" > settime.out.$zone.1 2>&1 281 # Fake lifetime of old algorithm keys. 282 echo "Lifetime: 0" >> "${CSK1}.state" 283 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile" 284 private_type_record $zone 5 "$CSK1" >> "$infile" 285 private_type_record $zone 13 "$CSK2" >> "$infile" 286 $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 287 288 # Step 4: 289 # The DS is swapped and can become OMNIPRESENT. 290 setup step4.csk-algorithm-roll.kasp 291 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $zone 2> keygen.out.$zone.1) 292 CSK2=$($KEYGEN -k csk-algoroll -l policies/csk2.conf $zone 2> keygen.out.$zone.1) 293 # The time passed since the DS has been swapped is 29 hours. 294 TactN="now-38h" 295 TpubN1="now-38h" 296 TactN1="now-35h" 297 TsubN1="now-29h" 298 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $O $TactN -r $O $TactN -z $O $TactN -d $U $TactN1 "$CSK1" > settime.out.$zone.1 2>&1 299 $SETTIME -s -P $TpubN1 -A $TpubN1 -g $O -k $O $TactN1 -r $O $TactN1 -z $O $TsubN1 -d $R $TsubN1 "$CSK2" > settime.out.$zone.1 2>&1 300 # Fake lifetime of old algorithm keys. 301 echo "Lifetime: 0" >> "${CSK1}.state" 302 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile" 303 private_type_record $zone 5 "$CSK1" >> "$infile" 304 private_type_record $zone 13 "$CSK2" >> "$infile" 305 $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 306 307 # Step 5: 308 # The DNSKEY is removed long enough to be HIDDEN. 309 setup step5.csk-algorithm-roll.kasp 310 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $zone 2> keygen.out.$zone.1) 311 CSK2=$($KEYGEN -k csk-algoroll -l policies/csk2.conf $zone 2> keygen.out.$zone.1) 312 # The time passed since the DNSKEY has been removed is 2 hours. 313 TactN="now-40h" 314 TpubN1="now-40h" 315 TactN1="now-37h" 316 TsubN1="now-31h" 317 TremN="now-2h" 318 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $U $TremN -r $U $TremN -z $U $TremN -d $H $TremN "$CSK1" > settime.out.$zone.1 2>&1 319 $SETTIME -s -P $TpubN1 -A $TpubN1 -g $O -k $O $TactN1 -r $O $TactN1 -z $O $TsubN1 -d $O $TremN "$CSK2" > settime.out.$zone.1 2>&1 320 # Fake lifetime of old algorithm keys. 321 echo "Lifetime: 0" >> "${CSK1}.state" 322 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile" 323 private_type_record $zone 5 "$CSK1" >> "$infile" 324 private_type_record $zone 13 "$CSK2" >> "$infile" 325 $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 326 327 # Step 6: 328 # The RRSIGs have been removed long enough to be HIDDEN. 329 setup step6.csk-algorithm-roll.kasp 330 CSK1=$($KEYGEN -k csk-algoroll -l policies/csk1.conf $zone 2> keygen.out.$zone.1) 331 CSK2=$($KEYGEN -k csk-algoroll -l policies/csk2.conf $zone 2> keygen.out.$zone.1) 332 # Additional time passed: 7h. 333 TactN="now-47h" 334 TpubN1="now-47h" 335 TactN1="now-44h" 336 TsubN1="now-38h" 337 TdeaN="now-9h" 338 TremN="now-7h" 339 $SETTIME -s -P $TactN -A $TactN -I now -g $H -k $H $TremN -r $U $TdeaN -z $U $TdeaN -d $H $TactN1 "$CSK1" > settime.out.$zone.1 2>&1 340 $SETTIME -s -P $TpubN1 -A $TpubN1 -g $O -k $O $TactN1 -r $O $TactN1 -z $O $TsubN1 -d $O $TactN1 "$CSK2" > settime.out.$zone.1 2>&1 341 # Fake lifetime of old algorithm keys. 342 echo "Lifetime: 0" >> "${CSK1}.state" 343 cat template.db.in "${CSK1}.key" "${CSK2}.key" > "$infile" 344 private_type_record $zone 5 "$CSK1" >> "$infile" 345 private_type_record $zone 13 "$CSK2" >> "$infile" 346 $SIGNER -S -x -z -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1 347
Indexes created Sat Feb 28 05:31:39 UTC 2026