Hello list,
I'm working on proof-of-concept integration between OpenDNSSEC enforcer and
FreeIPA.
Currently, aim of the project is to prove that it can be integrated (using
OpenDNSSECv1) and replace current hacky integration later when OpenDNSSECv2
with pluggable database backends is available.
As it was noted in the previous thread "enforcer hooks", all the necessary
information should be in XML files in /var/opendnssec/signconf/ directory.
However, I'm surprised that KSK has tag <KSK /> even if it is in state READY
but not active yet:
$ ods-ksmutil key list
Keys:
Zone: Keytype: State: Date of next transition:
test ZSK active 2014-06-13 17:01:49
test KSK ready waiting for ds-seen
$ cat /var/opendnssec/signconf/test.xml
<Keys>
<Key>
<Flags>257</Flags>
<KSK />
<Publish />
</Key>
I would expect that <KSK /> flag appears only after ds-seen command, i.e. when
the key reaches ACTIVE state.
It is intentional or is it a bug?
Thank you for answers and you time!
--
Petr Spacek @ Red Hat
_______________________________________________
Opendnssec-user mailing list
[email protected]
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user
