This archive is retained to ensure existing URLs remain functional. It will not contain any emails sent to this mailing list after July 1, 2024. For all messages, including those sent before and after this date, please visit the new location of the archive at https://mailman.ripe.net/archives/list/dns-wg@ripe.net/

[dns-wg] DNSSEC Validation Failures for RIPE NCC Zones

Previous message (by thread): [dns-wg] New on RIPE Labs: NXNSAttack: Upgrade Resolvers to Stop New Kind of Random Subdomain Attack
Next message (by thread): [dns-wg] DNSSEC Validation Failures for RIPE NCC Zones

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Anand Buddhdev anandb at ripe.net
Fri May 22 14:21:42 CEST 2020

Dear colleagues,

Yesterday afternoon (21 May 2020), our DNSSEC signer rolled the Zone 
Signing Keys (ZSKs) of all the zones we operate. Unfortunately, a bug in 
the signer caused it to withdraw the old ZSKs soon after the new keys 
began signing the zones.

Validating resolvers may have experienced some failures if they had 
cached signatures made by the old ZSKs.

We apologise for any operational problems this may have caused. We are 
looking at the issue with the developers of our Knot DNS signer to 
prevent such an occurrence in the future.

Regards,
Anand Buddhdev
RIPE NCC

Previous message (by thread): [dns-wg] New on RIPE Labs: NXNSAttack: Upgrade Resolvers to Stop New Kind of Random Subdomain Attack
Next message (by thread): [dns-wg] DNSSEC Validation Failures for RIPE NCC Zones

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

[ dns-wg Archives ]