Home / server / Questions / 741623
Accepted
eXe
Asked: 2015-12-09 08:40:28 +0800 CST

dnssec-keygen key default validation / expiration time

  • 772

What is the default expire time/period for a key, generated by dnssec-keygen:

If i execute: dnssec-keygen -a RSASHA256 -b 2048 -f KSK mydomain.com

I get 2 files:

(Kmydomain.com.+008+21346.key)

; This is a key-signing key, keyid 21346, for mydomain.com.
; Created: 20151208123320 (Tue Dec 08 13:33:20 2015)
; Publish: 20151208123320 (Tue Dec 08 13:33:20 2015)
; Activate: 20151208123320 (Tue Dec 08 13:33:20 2015)
mydomain.com. IN DNSKEY 257 3 8 AwEAAfcTOQq0VoMZFTKMPsRzUlO4cUzZvHCf9sb+MMeZhfMyLOSc6j6j hKtfYOVAwxDu7hEG5pG+5V908r7EAgZfjJgBPFlz6c3xZ9Yf5FqU4vRR CAAMye/87e2J4TKoFnv6J/8Vigz21IvKGYgdsXMs5Pf8rgqPgpZjXP+D gMxezJH1dQYV3oW6zULttm1/4+yeXZrc1NIzbmS3AChwKCNtP+fcj0dt PpV8Z8lcd0EnhZWCN7KZTgs8kzRHVGNKZSJ7Mvlklt74vNXnjpwsl3LL Uxi0ucXiWd7zB3eBA92+lH13QJPZnlUGe7iGiD4HYOeFAyRQGGYzd1Gf 3xwtWyF/3h8=

and (Kmydomain.com.+008+21346.private)

Private-key-format: v1.3
Algorithm: 8 (RSASHA256)
Modulus: 9xM5CrRWgxkVMow+xHNSU7hxTNm8cJ/2xv4wx5mF8zIs5JzqPqOEq19g5UDDEO7uEQbmkb7lX3TyvsQCBl+MmAE8WXPpzfFn1h/kWpTi9FEIAAzJ7/zt7YnhMqgWe/on/xWKDPbUi8oZiB2xcyzk9/yuCo+ClmNc/4OAzF7MkfV1BhXehbrNQu22bX/j7J5dmtzU0jNuZLcAKHAoI20/59yPR20+lXxnyVx3QSeFlYI3splOCzyTNEdUY0plInsy+WSW3vi81eeOnCyXcstTGLS5xeJZ3vMHd4ED3b6UfXdAk9meVQZ7uIaIPgdg54UDJFAYZjN3UZ/fHC1bIX/eHw==
PublicExponent: AQAB
PrivateExponent: vn6qry8luIRBTKzGxC5p3jTJ3kfOO0OKQBjBwVMD7OLVrBmznUHzyzGJgpgxDcA5+xTH9r0pGjUP57c2HHXU72mcfxeYv3kN5xDFvnUmmtpTAb7af1cSlt+EqsrgMwxHhCu2OZKhg3n5v3GtXDDUBMNj6K6HL65CiJp6VpgMv8btbDMBkc+eytFmJDIJ0FdOtlWxJYzFTZ6lAcxR7sSOidP/nKz8/5GLwwU/dxdMWS5xavzJYTZjG7ZQRwkTcEGZ9/PjgSzeqOUvJt2pcQXt6mi5/ZNpcC1843JYt+N6/O0sHSmphtv7WYOl5FOBYJP66akfv1XeNaYHKDZg+A+kUQ==
Prime1: /0oPncwFldrW/Iu3HmymBk4ntelWsKJgtaEZNXe7p5KXs4w8V48t+y2bz6k89ZSdR5cpVPmXd28BHqbODgetBkKKCi+P2+3N//7EuKr4qEVT/w7BWtp6+5zBnl6nBtblxz4RuBIb6kuues6GfHfIRMngeggxduuSCpOlSRyyGlc=
Prime2: 98NOx4xaPweAgz98gxPWXEQ6uB3CzVI1NFIGN1xGhS9qSq1FRWDe2bH5RjXh9m2tDCXC/TKzBjUfe3+xNKliO+Kkr7V45jpAlAfU2M3GKJ4Yqv9zHgk4ueQAtOFx6cQNywOLUnY4ms+JkmnWVWQxuBkcFPBY+9iuGLc3NbL9DXk=
Exponent1: qsieB9+MQQMk3dCOEbF3pDI2yLCwSPxoHDoIxkcyZ9le2UPQvnbPuQB7AwJiAJyKV3FdujY7STAenKXUpXgnHU/4TvYglG3TaRXD/xKJxPCUT8ZMPf55Vcg5kzwZGy86iv8QFYcv258Du65cM/piJPq0zI6coMTZb2/0nCOxVoM=
Exponent2: D578xJAQ0JCEhcHm88y4YzDaEumtcoyQVjAlvC/RMmx+4x5xk6I76rXR5Z9YE9VuZ6mp1ZTwvJ900LCIV62mR+hOQdXLPZjGoY6s2M6Ag+cT3xQkCezC6tV5Re5A5GA8DmS20AgsIXacUeLiZJfgmp7aqmdM9PQAZgaHMJeMZOE=
Coefficient: jmEpQL+U4NCvGrucQHHwdSlNphGI86rpuyB32vBs5khx1kiVyfj06/0yP2QAXjZv9DLoKxpfDwv7VGJb9hqr98E27zhdHzSNV5mo5COR7wMcApPfPZvu7k9pwiqf+MT1eNdzS31fOIp8APpaDMCnYPiIxbtynUHeUCU/etH2oxg=
Created: 20151208123320
Publish: 20151208123320
Activate: 20151208123320

As i thought the key(s) have a validation time, and will automaticly be revoked after the time is up.

Is there a default value for expiration - or do i have to manually set it via the -R flag as descriped @ the dnssec-keygen man page ?

Or did i missunderstood something completly wrong here?

bind

1 Answers

  1. Best Answer

    The default Times if you do not set them via params as descriped in the Manual from dnssec-keygen are:

    Published: {Time of creation}
Activated: {Time of creation}
Revoked: Not set
Retired: Not set
Deleted: Not set

    So if you do not set any Times on the Keys, it will be default last for ever (or until KSK will change and you HAVE to rotate the Key)

    U also have the ability to change the dates later via dnssec-settime

    • 2