[menog] FW: ICANN Launches Testing Platform for the KSK Rollover

[Fahd Batayneh]

ICANN Launches Testing Platform for the KSK Rollover. This is important for those who have DNSSEC deployments as part of their operations.

Fahd Batayneh
ICANN

Date: Monday, March 13, 2017 at 12:38 PM
Subject: ICANN News Alert -- ICANN Launches Testing Platform for the KSK Rollover

[ANN]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=pu7jN3q1ZBfuo7H0_TGgnLZ6DmTKXODkmnlRRHjLLAY&m=c7UCGDMiRYsW0lbWApGmj-zm4XN9jl-FEKs4jm05yIw&s=QRwxGfwQnrANnxoV-8nGf5mVCefJkBBu0JhzTXJVgxA&e=>
News Alert

https://www.icann.org/news/announcement-2017-03-13-en<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_news_announcement-2D2017-2D03-2D13-2Den&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=pu7jN3q1ZBfuo7H0_TGgnLZ6DmTKXODkmnlRRHjLLAY&m=c7UCGDMiRYsW0lbWApGmj-zm4XN9jl-FEKs4jm05yIw&s=tTWjf1YEVoojyhQxy_53GpkKXW9wo1QTliedfL-7JRQ&e=>

________________________________
ICANN Launches Testing Platform for the KSK Rollover

13 March 2017

13 March 2017 – ICANN is offering a testing platform for network operators and other interested parties to confirm that their systems can handle the automated update process for the upcoming Root Zone Domain Name Systems Security Extensions (DNSSEC) Key Signing Key (KSK) rollover. The KSK rollover is currently scheduled for 11 October 2017.

"Currently, seven hundred and fifty million people are using DNSSEC-validating resolvers that could be affected by the KSK rollover," said ICANN's Vice President of Research, Matt Larson. "The testing platform is an easy way for operators to confirm that their infrastructure supports the ability to handle the rollover without manual intervention."

Internet service providers, network operators and others who have enabled DNSSEC validation must update their systems with the new KSK. This can be done in one of two ways:

  *   An operator can configure a new trust anchor manually by obtaining the new root zone KSK from the iana.org website at https://www.iana.org/dnssec/files<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.iana.org_dnssec_files&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=pu7jN3q1ZBfuo7H0_TGgnLZ6DmTKXODkmnlRRHjLLAY&m=c7UCGDMiRYsW0lbWApGmj-zm4XN9jl-FEKs4jm05yIw&s=5NAr5uU9UgMqTrp9jvnYNeD1iywY0qPfTnXVfsLR0to&e=>.
  *   An operator can enable a feature available in many validating resolvers that automatically detects and configures a new root zone KSK as a trust anchor, in which case they need take no action.

Check to see if your systems are ready by visiting go.icann.org/KSKtest<https://urldefense.proofpoint.com/v2/url?u=http-3A__go.icann.org_KSKtest&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=pu7jN3q1ZBfuo7H0_TGgnLZ6DmTKXODkmnlRRHjLLAY&m=c7UCGDMiRYsW0lbWApGmj-zm4XN9jl-FEKs4jm05yIw&s=li2Xss94ViZCNi-F1A5P9SlXT6J4nhuDc8tws96Ayfo&e=>.

The KSK has been widely distributed and configured by every operator performing DNSSEC validation. If the validating resolvers using DNSSEC do not have the new key when the KSK is rolled, end users relying on those resolvers will encounter errors and be unable to access the Internet. A careful and coordinated effort is required to ensure that the update does not interfere with normal operations.

More information is available at www.icann.org/kskroll<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_kskroll&d=DwMFaQ&c=FmY1u3PJp6wrcrwll3mSVzgfkbPSS6sJms7xcl4I5cM&r=pu7jN3q1ZBfuo7H0_TGgnLZ6DmTKXODkmnlRRHjLLAY&m=c7UCGDMiRYsW0lbWApGmj-zm4XN9jl-FEKs4jm05yIw&s=p5ac6QrqDt68Ukqe30MDaGOOfDY_Q3xpP1iXJ8UI8aU&e=>.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.menog.org/pipermail/menog/attachments/20170313/5884ca51/attachment.html