刘硕 <[email protected]> wrote on 10/16/2012 04:18:35 AM:
> Is it suitable for all the zones to share the same ZSK/KSK? Would > this cause some other some operation problems? Or should I am just starting with DNSSEC and asked the same question on another list. I was told that you can do it. The trade-off is simplicity vs. security. If the key for one zone is compromised, it affects all zones. Also, all zones need to rollover at the same time. The suggestion made on that list was to not share the keys. Confidentiality Notice: This electronic message and any attachments may contain confidential or privileged information, and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agent responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachments. Please notify the sender immediately by return e-mail or telephone and delete this message from your system.
_______________________________________________ Opendnssec-user mailing list [email protected] https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
