[ksk-rollover] 15 days into the add-hold for KSK-2017

Olaf Kolkman kolkman at isoc.org
Thu Jul 27 12:37:11 UTC 2017




Has there been _any_ feedback on the changes so far? Did the increase in the DNSKEY RR set trigger anything?

Is there any advice we can give to resolver ops in a month or so? Like check your trust anchor it should now contain <blob>?

—Olaf



On 26 Jul 2017, at 7:08, Edward Lewis wrote:

> Wanted to "mark the occasion" and ask if there are any further concerns?
>
> RFC-5011 following servers ought to be about halfway to trusting KSK-2017 about this day, with the add-hold expiring around August 11, give or take time zones and when probing happened.
>
> That's halfway to "trusting" the key.  There's still 2.5 more months (October 11) until signatures by KSK-2017 appear.
>
> _______________________________________________
> ksk-rollover mailing list
> ksk-rollover at icann.org
> https://mm.icann.org/mailman/listinfo/ksk-rollover
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/ksk-rollover/attachments/20170727/332310a7/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3763 bytes
Desc: S/MIME digital signature
URL: <http://mm.icann.org/pipermail/ksk-rollover/attachments/20170727/332310a7/smime.p7s>


More information about the ksk-rollover mailing list