News for hackers. Stuff that matters.

A comment on For DNSSEC. Parent comment

Re:For DNSSEC by indolering on Thursday August 06, 2015 @04:39PM (#10019288)
Signing DNS records using a machine connected to the internet, instead of passing the zone files to an air-gapped signing machine over a sneakernet. Eventually, you run into the issue of updating the "offline" machine and many places just have an "online" machine that gets the zone files through a highly restricted interface.
[ Parent | on HN ]
Re:For DNSSEC by realityking on Thursday August 06, 2015 @06:48PM (#10019936)
We're currently working on providing DNSSEC for our customers. The problem with only signing is that we really don't want all the keys to be physically present on our DNS servers, as many of them are hosted in other companies data centres.

Having a central online signing server is bad for availability, as DNS down time is really not acceptable.

That basically only leaves offline signing.

[ Parent | on HN ]
Re:For DNSSEC by Habbie on Tuesday August 11, 2015 @01:23PM (#10042784)
So have three online signers.
[ Parent | on HN ]
Re:For DNSSEC by yuhong on Thursday August 13, 2015 @03:36AM (#10052720)
Yea, HSMs are not that expensive I think.
[ Parent | on HN ]