dnssec-keygen 密钥默认验证/过期时间

dnssec-keygen 密钥默认验证/过期时间

dnssec-keygen 生成的密钥的默认过期时间/期限是多少:

如果我执行: dnssec-keygen -a RSASHA256 -b 2048 -f KSK mydomain.com

我得到两个文件:

(Kmydomain.com.+008+21346.key)

; This is a key-signing key, keyid 21346, for mydomain.com.
; Created: 20151208123320 (Tue Dec 08 13:33:20 2015)
; Publish: 20151208123320 (Tue Dec 08 13:33:20 2015)
; Activate: 20151208123320 (Tue Dec 08 13:33:20 2015)
mydomain.com. IN DNSKEY 257 3 8 AwEAAfcTOQq0VoMZFTKMPsRzUlO4cUzZvHCf9sb+MMeZhfMyLOSc6j6j hKtfYOVAwxDu7hEG5pG+5V908r7EAgZfjJgBPFlz6c3xZ9Yf5FqU4vRR CAAMye/87e2J4TKoFnv6J/8Vigz21IvKGYgdsXMs5Pf8rgqPgpZjXP+D gMxezJH1dQYV3oW6zULttm1/4+yeXZrc1NIzbmS3AChwKCNtP+fcj0dt PpV8Z8lcd0EnhZWCN7KZTgs8kzRHVGNKZSJ7Mvlklt74vNXnjpwsl3LL Uxi0ucXiWd7zB3eBA92+lH13QJPZnlUGe7iGiD4HYOeFAyRQGGYzd1Gf 3xwtWyF/3h8=

和(Kmydomain.com.+008+21346.private)

Private-key-format: v1.3
Algorithm: 8 (RSASHA256)
Modulus: 9xM5CrRWgxkVMow+xHNSU7hxTNm8cJ/2xv4wx5mF8zIs5JzqPqOEq19g5UDDEO7uEQbmkb7lX3TyvsQCBl+MmAE8WXPpzfFn1h/kWpTi9FEIAAzJ7/zt7YnhMqgWe/on/xWKDPbUi8oZiB2xcyzk9/yuCo+ClmNc/4OAzF7MkfV1BhXehbrNQu22bX/j7J5dmtzU0jNuZLcAKHAoI20/59yPR20+lXxnyVx3QSeFlYI3splOCzyTNEdUY0plInsy+WSW3vi81eeOnCyXcstTGLS5xeJZ3vMHd4ED3b6UfXdAk9meVQZ7uIaIPgdg54UDJFAYZjN3UZ/fHC1bIX/eHw==
PublicExponent: AQAB
PrivateExponent: vn6qry8luIRBTKzGxC5p3jTJ3kfOO0OKQBjBwVMD7OLVrBmznUHzyzGJgpgxDcA5+xTH9r0pGjUP57c2HHXU72mcfxeYv3kN5xDFvnUmmtpTAb7af1cSlt+EqsrgMwxHhCu2OZKhg3n5v3GtXDDUBMNj6K6HL65CiJp6VpgMv8btbDMBkc+eytFmJDIJ0FdOtlWxJYzFTZ6lAcxR7sSOidP/nKz8/5GLwwU/dxdMWS5xavzJYTZjG7ZQRwkTcEGZ9/PjgSzeqOUvJt2pcQXt6mi5/ZNpcC1843JYt+N6/O0sHSmphtv7WYOl5FOBYJP66akfv1XeNaYHKDZg+A+kUQ==
Prime1: /0oPncwFldrW/Iu3HmymBk4ntelWsKJgtaEZNXe7p5KXs4w8V48t+y2bz6k89ZSdR5cpVPmXd28BHqbODgetBkKKCi+P2+3N//7EuKr4qEVT/w7BWtp6+5zBnl6nBtblxz4RuBIb6kuues6GfHfIRMngeggxduuSCpOlSRyyGlc=
Prime2: 98NOx4xaPweAgz98gxPWXEQ6uB3CzVI1NFIGN1xGhS9qSq1FRWDe2bH5RjXh9m2tDCXC/TKzBjUfe3+xNKliO+Kkr7V45jpAlAfU2M3GKJ4Yqv9zHgk4ueQAtOFx6cQNywOLUnY4ms+JkmnWVWQxuBkcFPBY+9iuGLc3NbL9DXk=
Exponent1: qsieB9+MQQMk3dCOEbF3pDI2yLCwSPxoHDoIxkcyZ9le2UPQvnbPuQB7AwJiAJyKV3FdujY7STAenKXUpXgnHU/4TvYglG3TaRXD/xKJxPCUT8ZMPf55Vcg5kzwZGy86iv8QFYcv258Du65cM/piJPq0zI6coMTZb2/0nCOxVoM=
Exponent2: D578xJAQ0JCEhcHm88y4YzDaEumtcoyQVjAlvC/RMmx+4x5xk6I76rXR5Z9YE9VuZ6mp1ZTwvJ900LCIV62mR+hOQdXLPZjGoY6s2M6Ag+cT3xQkCezC6tV5Re5A5GA8DmS20AgsIXacUeLiZJfgmp7aqmdM9PQAZgaHMJeMZOE=
Coefficient: jmEpQL+U4NCvGrucQHHwdSlNphGI86rpuyB32vBs5khx1kiVyfj06/0yP2QAXjZv9DLoKxpfDwv7VGJb9hqr98E27zhdHzSNV5mo5COR7wMcApPfPZvu7k9pwiqf+MT1eNdzS31fOIp8APpaDMCnYPiIxbtynUHeUCU/etH2oxg=
Created: 20151208123320
Publish: 20151208123320
Activate: 20151208123320

我认为密钥有一个验证时间,并且时间到了之后会自动撤销。

是否有到期的默认值 - 或者我必须通过标志手动设置它,-R如 @ 所述dnssec-keygen 手册页

或者我误解了这里某些完全错误的东西?

答案1

如果你没有按照来自 dnssec-keygen 的手册是:

出版日期:{创作时间}
已激活:{创建时间}
已撤销:未设置
已退休:未设定
已删除:未设置

因此,如果您没有在密钥上设置任何时间,它将默认永远持续下去(或者直到 KSK 发生变化并且您必须轮换密钥)

您也可以稍后通过以下方式更改日期dnssec 设置时间

相关内容