diff options
| author | Doug Barton <dougb@FreeBSD.org> | 2011-07-16 10:49:33 +0000 |
|---|---|---|
| committer | Doug Barton <dougb@FreeBSD.org> | 2011-07-16 10:49:33 +0000 |
| commit | 473038528ab5bd55332138ebf791ab91a25f747b (patch) | |
| tree | cb160fa2acd93f24b5f5b9082cd3afc68396d51a /KNOWN-DEFECTS | |
| parent | 46da9ebeb3b1241e2e7f0182d76c336966e91d20 (diff) | |
Diffstat (limited to 'KNOWN-DEFECTS')
| -rw-r--r-- | KNOWN-DEFECTS | 15 |
1 files changed, 0 insertions, 15 deletions
diff --git a/KNOWN-DEFECTS b/KNOWN-DEFECTS deleted file mode 100644 index 83d71759740e..000000000000 --- a/KNOWN-DEFECTS +++ /dev/null @@ -1,15 +0,0 @@ -dnssec-signzone was designed so that it could sign a zone partially, using -only a subset of the DNSSEC keys needed to produce a fully-signed zone. -This permits a zone administrator, for example, to sign a zone with one -key on one machine, move the resulting partially-signed zone to a second -machine, and sign it again with a second key. - -An unfortunate side-effect of this flexibility is that dnssec-signzone -does not check to make sure it's signing a zone with any valid keys at -all. An attempt to sign a zone without any keys will appear to succeed, -producing a "signed" zone with no signatures. There is no warning issued -when a zone is not signed. - -This will be corrected in a future release. In the meantime, ISC -recommends examining the output of dnssec-signzone to confirm that -the zone is properly signed by all keys before using it. |