[ksk-rollover] (Un)planning future KSK replacements

Phil Regnauld regnauld at nsrc.org
Fri Mar 29 09:11:25 UTC 2019

Salz, Rich via ksk-rollover (ksk-rollover) writes:
>   *   I mostly agree with this, and would totally agree if we were completely 5011 based, but that's not the case.  I think there needs to be an "interested parties" announcement even if this isn't announced widely.  E.g. ISPs that do manual configuration on roll-their-own DNS resolvers etc.
> If you pre-announce to interested parties, then you are not helping those parties learn how to handle unannounced emergencies.


	The one thing that worries me most here is that if we don't make
	KSK rollovers part of something your software and/or distro deals
	with automatically, each pre-announced roll will result in huge
	amounts of of time and resources wasted on long threads on various
	mailing lists, with the risk of bringing the n+1 roll to a grinding
	halt if the least doubt arises. We are nearly 9 *years* into the
	signed root. Mission accomplished ?

	As Pieter wrote:

> There are non-5011 ways to get the anchors (e.g. time fetches of the
> XML). But a list for announcements to interested parties, without the
> publication fanfare makes sense to not spring this on people.

	... so yeah, work with the vendors/distros, make this as automatic
	and normal as possible, so we can use our time on other issues that
	haven't been solved yet ;)


More information about the ksk-rollover mailing list