Alteon Application Switch Operating System Application Guide
Global Server Load Balancing
Document ID: RDWR-ALOS-V2900_AG1302
749
4. The system administrator is notified through SNMP, console, or e-mail that a new emergency
KSK has been created.
5. The KSK rollover is counted to zero.
6. The RR of the Parent must point to the new DNSKEY.
7. A timeout of 48 hours in addition to the TTL of the original KSK starts.
8. The old DNSKEY is removed.
9. The system administrator is notified through SNMP, console, or e-mail that a new emergency
KSK is in place.
10. All KSKs linked to this KSK are signed with the expiration that was set by the user.
Importing and Exporting Keys
After a key is created, it is imported and exported as necessary.
•
DNSSEC keys are exported either for backup purposes or to export of a DS record to be signed
by the parent of the domain. DNSSEC keys can be exported in their entirety (private and public
keys), just like SSL keys. For more information regarding SSL keys, see
Encryption and Authentication, page 337
In addition, DNSSEC keys can be exported publicly (either a DS or DNSKEY), where only the
public key is exported.
When a private key is exported, it is encrypted with a one-time passphrase supplied at the time
of export. This same passphrase is supplied during import for decrypting of the keys.
When exporting keys, the digital properties of the keys are exported regardless of the zone
assignments.
During a DNSSEC private key export, the digital part of the key (private and public) is exported,
and the key does not hold any relevant zone information. The zone information is only part of
the DNSKEY Zone assignment.
When exporting a public key, only the DNSKEY with all the relevant DNSSEC key properties and
features (DS, TTLS, zone assignment, timer values and so on) is exported. When exporting a
KSK in DS format, the key must be signed by the parent of the domain. Make sure to manually
send the DS export to be signed by the parent of the domain.
•
When importing keys, you import DNSSEC key properties, such as timers, which require user
input. After importing, a DNSKEY is not functional unless it is assigned to a zone.
To import a key
ZSKs and KSKs are imported in the same way.
1. Access the DNSSEC import menu.
2. Select the zone from which the ZSK or KSK are imported.
>> /cfg/slb/gslb/dnssec/import
