-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/23/2012 09:32 AM, 刘硕 wrote: > Hi Matthijs, > >> Note that the inception and expiration times are in UTC, see RFC >> 4034: > > Thanks, I forgot the time zone issue. > > >> So if you sign at 20/8/2012 17:08 P.M. and the inception is at >> 20/8/2012 08:08 A.M, you are in UTC+8 (17 minus 8 for the UTC >> minus 1 for the offset = 8), is that right? > > Yes, you are right. I have put less attention on <InceptionOffset>, > is there any recommendation for its value? > >
Inception offset is to defend against clock skew. The default policy has an offset of 1 hour, which I believe is a value almost everybody uses. Best regards, Matthijs -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJQNel3AAoJEA8yVCPsQCW5aoUIAK1eBloGFy6+2EF27ADoK1oE nvapvTf34Vh2BYaWGWXJ8pz+FHHPmQiFsqS22X9RvOonDY3ijeTyg3Y2DBwrdxzX igYPFTz/vwkgSzrVE3zy5IlzXtQENwoDe3PYX19aAJxdlWGPacNwbW+uPLY/BwpH 3IFPP0TYIwI5WYq5uu/UEcpOCdX5suBXKY9lgs2sRnwFw16pq5t/m8CExBwP5Qxl /AHYmhxcK17Lx0NXzj8JqmFn5PtCqV+Echeu3mgLgy/d6inG9qfmZNhir7g7mzkm +K84N0i3ri1qa+7R8jyA0SoJfN5/zG6vVSvle4NJbPkzcAqHU5uoEZvwQTOFEVE= =hLsq -----END PGP SIGNATURE----- _______________________________________________ Opendnssec-user mailing list [email protected] https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
