mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-26 19:41:04 -05:00
45dcabf411
Add a new option 'purge-keys' to 'dnssec-policy' that will purge key
files for deleted keys. The option determines how long key files
should be retained prior to removing the corresponding files from
disk.
If set to 0, the option is disabled and 'named' will not remove key
files from disk.
(cherry picked from commit 313de3a7e2)
25 lines
454 B
Text
25 lines
454 B
Text
dnssec-policy "default" {
|
|
// Keys
|
|
keys {
|
|
csk key-directory lifetime unlimited algorithm 13;
|
|
};
|
|
|
|
// Key timings
|
|
dnskey-ttl 3600;
|
|
publish-safety 1h;
|
|
retire-safety 1h;
|
|
purge-keys P90D;
|
|
|
|
// Signature timings
|
|
signatures-refresh 5d;
|
|
signatures-validity 14d;
|
|
signatures-validity-dnskey 14d;
|
|
|
|
// Zone parameters
|
|
max-zone-ttl 86400;
|
|
zone-propagation-delay 300;
|
|
|
|
// Parent parameters
|
|
parent-ds-ttl 86400;
|
|
parent-propagation-delay 1h;
|
|
};
|