config 1:
dnssec-keygen -f KSK -a RSASHA1 -b 512 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -n ZONE edu.com.
dnssec-signzone -o edu.com. db.edu.com
systemctl restart named
dnssec-signzone -o com. db.com
systemctl restart named
localdns:
systemctl restart named
config 2:
dnssec-keygen -f KSK -a RSASHA1 -b 512 -P 20160727093000 -A 20160727093000 -R 20170727094500 -I 20170727100000 -D 20170727100000 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -P 20160727093000 -A 20160727093000 -R 20160727094500 -I 20160727100000 -D 20160727100000 -n ZONE edu.com.
dnssec-signzone -s 20160827093000 -e 20160827094500 -X 20160827095000 -o edu.com. db.edu.com
dnssec-keygen -f KSK -a RSASHA1 -b 512 -P 20160801013000 -A 20160801013000 -R 20160827094500 -I 20160827100000 -D 20160827100000 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -P 20160827013000 -A 20160827013000 -R 20160827094500 -I 20160827100000 -D 20160827100000 -n ZONE edu.com.
dnssec-keygen
-P: 公布一个key
-A: key处于激活状态
-R: 撤销一个key
-I: key处于非激活状态
-D:删除key
dnssec-signzone
-S:自动回滚标志(自动回滚配合密钥时间参数)
-s:密钥签名生效时间
-e:密钥签名失效时间
-X:密钥签名超时时间
dnssec-keygen -f KSK -a RSASHA1 -b 512 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -n ZONE edu.com.
dnssec-signzone -o edu.com. db.edu.com
systemctl restart named
dnssec-signzone -o com. db.com
systemctl restart named
localdns:
systemctl restart named
config 2:
dnssec-keygen -f KSK -a RSASHA1 -b 512 -P 20160727093000 -A 20160727093000 -R 20170727094500 -I 20170727100000 -D 20170727100000 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -P 20160727093000 -A 20160727093000 -R 20160727094500 -I 20160727100000 -D 20160727100000 -n ZONE edu.com.
dnssec-signzone -s 20160827093000 -e 20160827094500 -X 20160827095000 -o edu.com. db.edu.com
dnssec-keygen -f KSK -a RSASHA1 -b 512 -P 20160801013000 -A 20160801013000 -R 20160827094500 -I 20160827100000 -D 20160827100000 -n ZONE edu.com.
dnssec-keygen -a RSASHA1 -b 512 -P 20160827013000 -A 20160827013000 -R 20160827094500 -I 20160827100000 -D 20160827100000 -n ZONE edu.com.
dnssec-keygen
-P: 公布一个key
-A: key处于激活状态
-R: 撤销一个key
-I: key处于非激活状态
-D:删除key
dnssec-signzone
-S:自动回滚标志(自动回滚配合密钥时间参数)
-s:密钥签名生效时间
-e:密钥签名失效时间
-X:密钥签名超时时间