ADC

Use case: Configure the automatic DNSSEC key management feature

February 27, 2024

Contributed by:

B C

Use the following steps to enable the auto rollover feature on a non-GSLB site.

Note

Use this procedure if you have a DNS deployment on a NetScaler and not required to replicate it on other devices.

In this example, we have used the following details:

Domain name: example.com
Origin Server: nameserver1.example.com
NameServer: nameserver2.example.com
Contact: admin.example.com
Keys: Key 1 for ZSK and Key 2 for KSK

Create SOA and NS record (name is to be the same as zone name)

At the command prompt, type:

add dns soaRec example.com -originServer nameserver1.example.com -contact admin.example.com
 

Create a DNS zone record. Set the proxy mode to No for authoritative zones.
```
add dns zone example.com  -proxyMode no
 
```

Create DNS keys

Note:

The command creates three files in the system with the filename prefix: private, key, and ds.

create dns key -zoneName example.com -fileNamePrefix Key1.zsk -keytype zsk -keysize 1024 -algorithm rsASHA256
create dns key -zoneName example.com -fileNamePrefix Key2.ksk -keytype ksk -keysize 1024 -algorithm rsASHA256
 

Publish the keys in the zone.

Note:

Enable the automatic rollover option and specify the expiration date, along with the notification period. A warning message is displayed regarding the activation of the key.

add dns key Key1.zsk Key1.zsk.key Key1.zsk.private -autoRollover enABLED -expires 30 days -notificationPeriod 7 days -rolloverMethod doublesignature

Warning: The key should be in an activated state for rollover. Please use sign DNS zone operation to activate the key
Done

 add dns key Key2.ksk Key2.ksk.key Key2.ksk.private -autoRollover enABLED -expires 120 days -notificationPeriod 15 days -rolloverMethod doublerrSet

Warning: The key should be in an activated state for rollover. Please use sign DNS zone operation to activate the key
Done
 

Activate the key using the sign zone command.

sign dns zone example.com -keyName Key1.zsk Key2.ksk
Update the DS record for the new key in the parent zone.
Enable the auto-save key option in DNS parameters.

set dns parameter -autosaveKeyOps enABLED

Note:

To ensure timely monitoring of all key activity, an SNMP alarm is sent. The SNMP alarms are sent for newly generated keys once the active keys are deleted.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Use case: Configure the automatic DNSSEC key management feature

February 27, 2024

Contributed by:

B C

Was this helpful

Use case: Configure the automatic DNSSEC key management feature

In this article