19 Led
2017
19 Led
'17
21:08
Hi,
can someone please give me any explanation (or command) how my domain
registrator got from this record what i give him:
liberland.cz. 3600 DNSKEY 257 3 13
ei9T3egqng+nlAHeNfF6BzggGCyvS2lU5ih2BZuvkzFGxkBdUJ0blgSiW5iYIROvAEHQv5Ls3sNPA9JIt8iRjg==
this record:
liberland.cz. 17999 IN DS 21107 13 2
9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB
???
I want sign child zones but I can't find where i get hash
,,9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB"
And algorithm in RFC:
https://tools.ietf.org/html/rfc4034#section-5.4
digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);
"|" denotes concatenation
DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key.
doesn't help me :-/
Thanks and regards,
Jakub
19 Led
19 Led
22:13
On 19/01/2017 21:08, Jakub Andrys wrote:
Hi Jakub,
You question isn't really about Knot DNS. Nevertheless, see my answers
below.
can someone please give me any explanation (or
command) how my domain
registrator got from this record what i give him:
liberland.cz. 3600 DNSKEY 257 3 13
ei9T3egqng+nlAHeNfF6BzggGCyvS2lU5ih2BZuvkzFGxkBdUJ0blgSiW5iYIROvAEHQv5Ls3sNPA9JIt8iRjg==
this record:
liberland.cz. 17999 IN DS 21107 13 2
9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB
???
In order for your registrar to request secure delegation for your zone,
they have to update the .CZ zone with a DS record of your DNSKEY. They
generate this DS record from the DNSKEY you provided. If you want to
generate this DS record yourself, you can do that with the LDNS tools.
Save your entire DNSKEY record to a file, and then run:
ldns-key2ds -n <filename>
This will print out the DS record on standard output.
I want sign child zones but I can't find where i
get hash
,,9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB"
You don't need the DS record to sign your zone. You need the private
component of your DNSKEY. You should have this file somewhere on disk
when you generated the keypair.
Regards,
Anand Buddhdev
22:16
Hello Jakub,
You can use dnssec-dsfromkey command from Bind utils:
echo "liberland.cz. 3600 DNSKEY 257 3 13
ei9T3egqng+nlAHeNfF6BzggGCyvS2lU5ih2BZuvkzFGxkBdUJ0blgSiW5iYIROvAEHQv5Ls3sNPA9JIt8iRjg=="
./key.txt
dnssec-dsfromkey -f ./key.txt
liberland.cz
Or some online converter (e.g. filippo.io/dnskey-to-ds).
Daniel
On 2017-01-19 21:08, Jakub Andrys wrote:
Hi,
can someone please give me any explanation (or command) how my domain
registrator got from this record what i give him:
liberland.cz. 3600 DNSKEY 257 3 13
ei9T3egqng+nlAHeNfF6BzggGCyvS2lU5ih2BZuvkzFGxkBdUJ0blgSiW5iYIROvAEHQv5Ls3sNPA9JIt8iRjg==
this record:
liberland.cz. 17999 IN DS 21107 13 2
9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB
???
I want sign child zones but I can't find where i get hash
,,9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB"
And algorithm in RFC:
https://tools.ietf.org/html/rfc4034#section-5.4
digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);
"|" denotes concatenation
DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key.
doesn't help me :-/
Thanks and regards,
Jakub
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
20 Led
20 Led
12:26
Thank you very much every one for help!
This is the magic command, which I could not find.
For Anand: I need it for child zone delegation, like: gov.liberland.cz
Now it works: http://dnssec-debugger.verisignlabs.com/gov.liberland.cz
Thank you again, regards
Jakub
Dne 19.1.2017 v 22:16 daniel.salzman(a)nic.cz napsal(a):
Hello Jakub,
You can use dnssec-dsfromkey command from Bind utils:
echo "liberland.cz. 3600 DNSKEY 257 3 13
ei9T3egqng+nlAHeNfF6BzggGCyvS2lU5ih2BZuvkzFGxkBdUJ0blgSiW5iYIROvAEHQv5Ls3sNPA9JIt8iRjg=="
./key.txt
dnssec-dsfromkey -f ./key.txt
liberland.cz
Or some online converter (e.g. filippo.io/dnskey-to-ds).
Daniel
On 2017-01-19 21:08, Jakub Andrys wrote:
> Hi,
> can someone please give me any explanation (or command) how my domain
> registrator got from this record what i give him:
> liberland.cz. 3600 DNSKEY 257 3 13
>
ei9T3egqng+nlAHeNfF6BzggGCyvS2lU5ih2BZuvkzFGxkBdUJ0blgSiW5iYIROvAEHQv5Ls3sNPA9JIt8iRjg==
>
>
> this record:
> liberland.cz. 17999 IN DS 21107 13 2
> 9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB
> ???
>
> I want sign child zones but I can't find where i get hash
> ,,9405F3324FDCE3F0CC4E5D94CBFB5D8A4F211E3010D447B5FD73765F9EEC20EB"
>
> And algorithm in RFC:
> https://tools.ietf.org/html/rfc4034#section-5.4
>
> digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);
> "|" denotes concatenation
> DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key.
>
> doesn't help me :-/
>
> Thanks and regards,
> Jakub
> _______________________________________________
> knot-dns-users mailing list
> knot-dns-users(a)lists.nic.cz
> https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
2658
days inactive
2659
days old
3 comments
3 participants
participants (3)
-
Anand Buddhdev -
daniel.salzman＠nic.cz -
Jakub Andrys