# Introduction

Key rollover using OpenDNSSEC

## Notes

- Commands preceded with “$” imply that you should execute the command as a general user - not as root.
- Commands preceded with “#” imply that you should be working as root.
- Commands with more specific command lines (e.g. “rtrX>” or “mysql>”) imply that you are executing commands on remote equipment, or within another program.

# On your authoritative server (SOA)

## Make sure that your zone is validating correctly.

Things to verify (also if your zone works!):

- look at the key id of your KSK:

    # ods-enforcer key list -v --zone mytld

- is BIND loading the right zone? (compare SOA serial value in `/var/lib/opendnssec/signed` with that returned by `dig @soa.grpX.dns SOA mytld`

- verify that the right DS is loaded in the root zone:

    $ dig @ns1.root DS mytld

- compare the key ID of the DS in the root (output from above) with that of the key used to sign your DNSKEY RR

    $ dig @soa.grpX.dns DNSKEY mytld +dnssec +multi

Look for the key id on the RRSIG.

If there are any problems problems, correct them.

Remember to check that the serial on the master is HIGHER than the serial on your slave server(s) !

## Check the key states

    # ods-enforcer key list -v --zone mytld

You should have at least one KSK in `active` or `publish` state, and one or more ZSKs (one `active` and possibly others in `retire` or `publish` state).

## Trigger a ZSK rollover

Since we have very short timers for this lab, rollovers have already been happening automatically on the ZSK! What happens if we decide to do a rollover manually ?

    # ods-enforcer key rollover --zone mytld --keytype ZSK

You should see this output:

    Manual key rollover for key type zsk on zone mytld initiated
    Notifying enforcer of new database...

Check the logs:

    # tail /var/log/syslog

You may see a message similar to this:

    Mar 21 09:38:57 soa ods-enforcerd: WARNING: ZSK rollover for zone 'mytld'
    not completed as there are no keys in the 'ready' state; ods-enforcerd will
    try again when it runs next

From the OpenDNSSEC documentation (https://wiki.opendnssec.org/display/DOCS/Frequently+Asked+Questions)

> OpenDNSSEC makes sure that the zone is secure during the rollover process. This message comes when there is no key that has been published long enough. You probably have no standby keys in your policy. When you initiate the rollover, then OpenDNSSEC first needs to publish the key and after a moment make it active. So do not worry, the rollover process will be finished in a moment.

The reason you are seeing this is because we are using very short timers in this lab, and keys are not published very long, before they have to be rolled already.

Wait a few seconds, then show the keys again

    # ods-enforcer key list -v --zone mytld

You should see 3 keys:

- 1 KSK in state ‘ready’, with a next transition of ‘waiting for ds-seen’
- 1 ZSK in state ‘active’ (the previous ZSK)
- 1 new ZSK in state ‘publish’

Effectively, OpenDNSSEC is now rolling ZSKs automatically. It will do this without your help, but you can always trigger a rollover for emergency reasons.

## Testing a KSK rollover

Take a look at the existing keys:

    # ods-enforcer key list -v

    Keys:
    Zone:                           Keytype:      State:    Date of next transition (to):  Size:   Algorithm:  CKA_ID:                           Repository:                       Keytag:
    mytld                           KSK           active    2014-03-22 09:06:56 (retire)   2048    8           0c4f577032e04e2eb34163382a4524d7  SoftHSM                           44096
    mytld                           ZSK           active    2014-03-21 11:53:07 (retire)   1024    8           b33d11faf20c649793a0d502fdf15f79  SoftHSM                           48718
    mytld                           ZSK           publish   2014-03-21 12:01:07 (ready)    1024    8           816e4714df87ffdaddb014481dfcd168  SoftHSM                           64656

Now, let’s issue a rollover. Remember, KSK rollovers can’t happen automatically in most cases, so you will need to help OpenDNSSEC by:

- exporting the DS of the new key once you initiate the rollover (`ods-enforcer key export --zone mytld --keystate ...`)

- telling OpenDNSSEC when you can see that the root/parent has included your DS in their zone (`ods-enforcer key ds-seen --zone mytld --keytag XXXXX`)

Ok, let’s rollover:

    # ods-enforcer key rollover --keytype KSK --zone mytld

Look at the key states:

    # ods-enforcer key list

    Keys:
    Zone:                           Keytype:      State:    Date of next transition:
    mytld                           KSK           active    2014-03-21 11:57:18
    mytld                           KSK           publish   2014-03-21 12:05:19
    mytld                           ZSK           active    2014-03-21 11:53:07
    mytld                           ZSK           publish   2014-03-21 12:01:07

You should see that there is now an extra KSK

** REMEMBER: during a rollover you have two keys in your zone. In the case of a KSK rollover, that means you will have two DS records in the root zone. When you send a new DS RRSet to the root zone to be published there, it should include one DS record for each key. Two KSKs, two DS RRs. **

We leave the rest of this exercise up to you :)

## See what rollovers are automatically planned, and when

    # ods-enforcer rollover list