Matthijs Mekking 8134d46cdb Error if key lifetime is too short ... The key lifetime should not be shorter than the time it costs to introduce the successor key, otherwise keys will be created faster than they are removed, resulting in a large key set. The time it takes to replace a key is determined by the publication interval (Ipub) of the successor key and the retire interval of the predecessor key (Iret). For the ZSK, Ipub is the sum of the DNSKEY TTL and zone propagation delay (and publish safety). Iret is the sum of Dsgn, the maximum zone TTL and zone propagation delay (and retire safety). The sign delay is the signature validity period minus the refresh interval: The time to ensure that all existing RRsets have been re-signed with the new key. The ZSK lifetime should be larger than both values. For the KSK, Ipub is the sum of the DNSKEY TTL and zone propagation delay (and publish safety). Iret is the sum of the DS TTL and parent zone propagation delay (and retire safety). The KSK lifetime should be larger than both values.		2022-05-31 15:45:14 +02:00
..
include	add a CFG_CLAUSEFLAG_NODOC flag for use with outdated terms	2022-02-25 16:33:30 -08:00
aclconf.c	Clean up #include <isc/string.h>	2022-05-03 12:38:59 +00:00
dnsconf.c	Update the copyright information in all files in the repository	2022-01-11 09:05:02 +01:00
kaspconf.c	Error if key lifetime is too short	2022-05-31 15:45:14 +02:00
log.c	Update the copyright information in all files in the repository	2022-01-11 09:05:02 +01:00
Makefile.am	Move all the unit tests to /tests/<libname>/	2022-05-28 14:53:02 -07:00
namedconf.c	Rename "hostname" to "remote-hostname" within "tls"	2022-05-03 17:15:43 +03:00
parser.c	Simplify way we tag unreachable code with only ISC_UNREACHABLE()	2022-03-25 08:33:43 +01:00
tests	Move all the unit tests to /tests/<libname>/	2022-05-28 14:53:02 -07:00