3 ms·
The old key was hosted inside a proprietary appliance and can't be extracted. https://labs.ripe.net/Members/anandb/the-future-of-dnssec-at-the-ripe-ncc https:/
by mappu 8y ago
The old key was hosted inside a proprietary appliance and can't be extracted.
https://labs.ripe.net/Members/anandb/the-future-of-dnssec-at-the-ripe-ncc https://labs.ripe.net/Members/anandb/the-future-of-dnssec-at...
https://labs.ripe.net/Members/anandb/dnssec-signer-migration https://labs.ripe.net/Members/anandb/dnssec-signer-migration """Our old Secure64 signers do not export their private keys. This means that in order to migrate to the new signers, we will have to perform a KSK roll-over."""
- pauldino 8y agoI'm pretty sure that's unrelated to the DNSSEC root key which is managed by IANA and not RIPE NCC. https://www.iana.org/dnssec https://www.iana.org/dnssec I'm guessing that's referring to signing the reverse DNS zones for their IP address allocations (193.in-addr.arpa for example) and it's just coincidentally timed with the DNSSEC root key rollover.
- pilif 8y agoIsn’t that a good thing? You don’t want to be able to export keys from a HSM.