README revision 29756974c585f616bb6e8233218cc385df9aeddb
29756974c585f616bb6e8233218cc385df9aeddbTinderbox UserCopyright (C) 2015 Internet Systems Consortium, Inc. ("ISC")
29756974c585f616bb6e8233218cc385df9aeddbTinderbox UserSee COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
591389c7d44e5ca20c357627dd179772cfefaaccEvan HuntThis is for testing managed-keys, in particular with problems
591389c7d44e5ca20c357627dd179772cfefaaccEvan Huntwith RFC 5011 Automated Updates of DNSSEC Trust Anchors.
591389c7d44e5ca20c357627dd179772cfefaaccEvan Huntns1 is the root server that offers new KSKs and hosts one record for
591389c7d44e5ca20c357627dd179772cfefaaccEvan Hunttesting. The TTL for the zone's records is 2 seconds.
591389c7d44e5ca20c357627dd179772cfefaaccEvan Huntns2 is a validator uses managed-keys.
591389c7d44e5ca20c357627dd179772cfefaaccEvan Hunt"named -T rfc5011holddown=4" switch is used so it will attempt to do
591389c7d44e5ca20c357627dd179772cfefaaccEvan Huntthe automated updates frequently.
591389c7d44e5ca20c357627dd179772cfefaaccEvan Huntns3 is a validator with a broken key in managed-keys.
591389c7d44e5ca20c357627dd179772cfefaaccEvan Hunt- initial working KSK
591389c7d44e5ca20c357627dd179772cfefaaccEvan HuntTODO: test using delv with new trusted key too
591389c7d44e5ca20c357627dd179772cfefaaccEvan Hunt- introduce a REVOKE bit
591389c7d44e5ca20c357627dd179772cfefaaccEvan Hunt- later remove a signature
591389c7d44e5ca20c357627dd179772cfefaaccEvan Hunt- corrupt a signature
591389c7d44e5ca20c357627dd179772cfefaaccEvan HuntTODO: also same things with dlv auto updates of trust anchor