6f97bb6b1f
Upon request from Mark, change the configuration of salt to salt length. Introduce a new function 'dns_zone_checknsec3aram' that can be used upon reconfiguration to check if the existing NSEC3 parameters are in sync with the configuration. If a salt is used that matches the configured salt length, don't change the NSEC3 parameters.
19 lines
594 B
ReStructuredText
19 lines
594 B
ReStructuredText
::
|
|
|
|
dnssec-policy <string> {
|
|
dnskey-ttl <duration>;
|
|
keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
|
|
<duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
|
|
max-zone-ttl <duration>;
|
|
nsec3param [ iterations <integer> ] [ optout <boolean> ] [
|
|
salt-length <integer> ];
|
|
parent-ds-ttl <duration>;
|
|
parent-propagation-delay <duration>;
|
|
publish-safety <duration>;
|
|
retire-safety <duration>;
|
|
signatures-refresh <duration>;
|
|
signatures-validity <duration>;
|
|
signatures-validity-dnskey <duration>;
|
|
zone-propagation-delay <duration>;
|
|
};
|