Home / server / Questions / 404457
Accepted
profy
Asked: 2012-07-04 08:50:57 +0800 CST

Inline signing with bind 9.9 and NSEC3

  • 772

Since version 9.9, Bind supports inline signing, but I don't find any information on how to make it working with NSEC3. I cannot add NSEC3PARAM RR with nsupdate : I think it's normal because of inline signing, but I cannot parameter this for inline signing.

Has someone setup and tested it, or an idea ?

Thanks for answers.

bind dnssec

1 Answers

  1. Best Answer

    Finally I found the answer on bind-user mailing list.

    Instead of using nsupdate, I should use the next command :

    rndc signing -nsec3param 1 1 100 $(head -c 512 /dev/random | sha1sum | cut -b 1-16) <zonename>

    Hope this question will help someone in the future.

    • 4