upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-13 22:22:08 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[v9_10] release note about new root key

Browse source
This commit is contained in:
Evan Hunt 2017-02-04 22:16:00 -08:00
parent 339223cdda
commit 84269e5e4c
1 changed files with 29 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
doc/arm/notes.xml
View file

@ -38,6 +38,35 @@
</para>
</section>
<section xml:id="root_key"><info><title>New DNSSEC Root Key</title></info>
<para>
ICANN is in the process of introducing a new Key Signing Key (KSK) for
the global root zone. BIND has multiple methods for managing DNSSEC
trust anchors, with somewhat different behaviors. If the root
key is configured using the <command>managed-keys</command>
statement, or if the pre-configured root key is enabled by using
<command>dnssec-validation auto</command>, then BIND can keep
keys up to date automatically. Servers configured in this way
will roll seamlessly to the new key when it is published in
the root zone. However, keys configured using the
<command>trusted-keys</command> statement are not automatically
maintained. If your server is performing DNSSEC validation
and is configured using <command>trusted-keys</command>, you are
advised to change your configuration before the root zone begins
signing with the new KSK. This is currently scheduled for
October 11, 2017.
</para>
<para>
This release includes an updated version of the
<filename>bind.keys</filename> file containing the new root
key. This file can also be downloaded from
<link xmlns:xlink="http://www.w3.org/1999/xlink"
xlink:href="https://www.isc.org/bind-keys">
https://www.isc.org/bind-keys
</link>.
</para>
</section>
<section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
<itemizedlist>
<listitem>