Matt Larson (matt.larson) writes:
>
>
> > Does anyone know what is the method for changing the KSK rollover today? I have tried to look for it in ICNN documents but I unfortunately I could not find it.
>
> I'm not sure I understand your question about methodology. At 1600 UTC today, 11 October (or shortly thereafter), a root zone will be published with only the "new" KSK (called KSK-2017) signing the root zone's apex DNSKEY RRset. Currently the root zone's apex DNSKEY RRset is signed only with the soon-to-be "old" KSK (called KSK-2010). The publication of this root zone implements the root KSK rollover.
To complement your answer, we can say this is a "pre-publish" type
rollover (as opposed to a double signature one) -- if that was what
Suhayb was referring to.
Cheers,
Phil
_______________________________________________
ksk-rollover mailing list
ksk-rollover@icann.org
https://mm.icann.org/mailman/listinfo/ksk-rollover