mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-27 03:51:16 -05:00
313de3a7e2
Add a new option 'purge-keys' to 'dnssec-policy' that will purge key files for deleted keys. The option determines how long key files should be retained prior to removing the corresponding files from disk. If set to 0, the option is disabled and 'named' will not remove key files from disk.
25 lines
454 B
Text
25 lines
454 B
Text
dnssec-policy "default" {
|
|
// Keys
|
|
keys {
|
|
csk key-directory lifetime unlimited algorithm 13;
|
|
};
|
|
|
|
// Key timings
|
|
dnskey-ttl 3600;
|
|
publish-safety 1h;
|
|
retire-safety 1h;
|
|
purge-keys P90D;
|
|
|
|
// Signature timings
|
|
signatures-refresh 5d;
|
|
signatures-validity 14d;
|
|
signatures-validity-dnskey 14d;
|
|
|
|
// Zone parameters
|
|
max-zone-ttl 86400;
|
|
zone-propagation-delay 300;
|
|
|
|
// Parent parameters
|
|
parent-ds-ttl 86400;
|
|
parent-propagation-delay 1h;
|
|
};
|