Home | History | Annotate | Line # | Download | only in policy 
      1 /*
      2  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
      3  *
      4  * SPDX-License-Identifier: MPL-2.0
      5  *
      6  * This Source Code Form is subject to the terms of the Mozilla Public
      7  * License, v. 2.0.  If a copy of the MPL was not distributed with this
      8  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
      9  *
     10  * See the COPYRIGHT file distributed with this work for additional
     11  * information regarding copyright ownership.
     12  */
     13 
     14 dnssec-policy "rsasha256-kasp" {
     15 	signatures-refresh P5D;
     16 	signatures-validity 30d;
     17 	signatures-validity-dnskey 30d;
     18 
     19 	keys {
     20 		ksk lifetime unlimited algorithm rsasha256;
     21 		zsk lifetime unlimited algorithm rsasha256;
     22 	};
     23 
     24 	dnskey-ttl 1h;
     25 	publish-safety PT1H;
     26 	retire-safety 2h;
     27 	zone-propagation-delay 3600;
     28 	max-zone-ttl 6h;
     29 	parent-propagation-delay pt1h;
     30 	parent-ds-ttl 7200;
     31 };
     32 
     33 dnssec-policy "rsasha256-manual" {
     34 	manual-mode yes;
     35 
     36 	signatures-refresh P5D;
     37 	signatures-validity 30d;
     38 	signatures-validity-dnskey 30d;
     39 
     40 	keys {
     41 		ksk lifetime unlimited algorithm rsasha256;
     42 		zsk lifetime unlimited algorithm rsasha256;
     43 	};
     44 
     45 	dnskey-ttl 1h;
     46 	publish-safety PT1H;
     47 	retire-safety 2h;
     48 	zone-propagation-delay 3600;
     49 	max-zone-ttl 6h;
     50 	parent-propagation-delay pt1h;
     51 	parent-ds-ttl 7200;
     52 };
     53 
     54 dnssec-policy "ecdsa256-kasp" {
     55 	signatures-refresh P5D;
     56 	signatures-validity 30d;
     57 	signatures-validity-dnskey 30d;
     58 
     59 	keys {
     60 		ksk lifetime unlimited algorithm ecdsa256;
     61 		zsk lifetime unlimited algorithm ecdsa256;
     62 	};
     63 
     64 	dnskey-ttl 1h;
     65 	publish-safety PT1H;
     66 	retire-safety 2h;
     67 	zone-propagation-delay 3600;
     68 	max-zone-ttl 6h;
     69 	parent-propagation-delay pt1h;
     70 	parent-ds-ttl 7200;
     71 };
     72 
     73 dnssec-policy "ecdsa256-manual" {
     74 	manual-mode yes;
     75 
     76 	signatures-refresh P5D;
     77 	signatures-validity 30d;
     78 	signatures-validity-dnskey 30d;
     79 
     80 	keys {
     81 		ksk lifetime unlimited algorithm ecdsa256;
     82 		zsk lifetime unlimited algorithm ecdsa256;
     83 	};
     84 
     85 	dnskey-ttl 1h;
     86 	publish-safety PT1H;
     87 	retire-safety 2h;
     88 	zone-propagation-delay 3600;
     89 	max-zone-ttl 6h;
     90 	parent-propagation-delay pt1h;
     91 	parent-ds-ttl 7200;
     92 };
     93