Re: Is it possible to use one KSK for multiple domains?

2008-11-20 Thread Stephane Bortzmeyer
On Wed, Nov 19, 2008 at 09:55:52PM +0100, Adam Tkac [EMAIL PROTECTED] wrote a message of 17 lines which said: If I understand correctly what RFC 4034, section 2.1.1 says ... If bit 7 has value 1, then the DNSKEY record holds a DNS zone key, and the DNSKEY RR's owner name MUST be the name of

Re: Is it possible to use one KSK for multiple domains?

2008-11-20 Thread Niall O'Reilly
On Wed, 2008-11-19 at 21:55 +0100, Adam Tkac wrote: does anyone know if is it possible to sign multiple domains with one KSK? Adam, I suspect your question may need to be more specific. Are you asking about the signing process itself, or rather about how

Re: Is it possible to use one KSK for multiple domains?

2008-11-20 Thread Stephane Bortzmeyer
On Thu, Nov 20, 2008 at 11:55:17AM +, Chris Thompson [EMAIL PROTECTED] wrote a message of 33 lines which said: The text you quote is for DNS publication. But you typically do not put KSK in the DNS, no? Sure you do. How could a validator use it if you didn't? Because it is published