<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi all, Following <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/Troubleshooting#DNSSEC_signing_does_not_work">http://www.freeipa.org/page/Troubleshooting#DNSSEC_signing_does_not_work</a> was most usefull, It turned out the package "freeipa-server-dns"was missing. Strange, I am running DNS, but...: <ul> <li>I upgraded form Fedora 22 to 23 includng upgrading from IPA 4.1 to 4.2. </li> <li>Also: I'm running this on a Bananapi "server".....</li> <li>There's no slave. </li> </ul> Anyway, ipa dnszone-show tells DNSsec was ebabled: Allow in-line DNSSEC signing: TRUE but most likely due to the missing freeipa-server-dns it was missing dependencies as well, for example the package opendnssec was missing. After installing freeipa-server-dns all packages seems to be in place, but the kasp.db file is empty: root@ipa ~]# ls -l /var/opendnssec/kasp.db -rw-rw----. 1 ods ods 0 Feb 22 11:29 /var/opendnssec/kasp.db No wonder I still get messages like "could not get zone keys". Shouldn't a key be added? How? (without blowing the current DNS....) Winny <div class="moz-cite-prefix">Op 22-02-16 om 11:10 schreef Petr Spaceopendnssec </div> <blockquote cite="mid:56CADEA2.80301@redhat.com" type="cite"> <pre wrap="">On 22.2.2016 09:36, Winfried de Heiden wrote: </pre> <blockquote type="cite"> <pre wrap="">Hi all, I get lot's of messages in my log (journalctl -u named-pkcs11.service -p err ) like these: Feb 22 09:17:32 ipa.example.com named-pkcs11[8982]: zone example.com/IN (signed): could not get zone keys for secure dynamic update Feb 22 09:17:32 ipa.example.com named-pkcs11[8982]: zone example.com/IN (signed): receive_secure_serial: not found Feb 22 09:19:06 ipa.example.com named-pkcs11[8982]: zone example.com/IN (signed): could not get zone keys for secure dynamic update Feb 22 09:19:06 ipa.example.com named-pkcs11[8982]: zone example.com/IN (signed): receive_secure_serial: not found Feb 22 09:20:06 ipa.example.com named-pkcs11[8982]: zone example.com/IN (signed): could not get zone keys for secure dynamic update Feb 22 09:20:06 ipa.example.com named-pkcs11[8982]: zone example.com/IN (signed): receive_secure_serial: not found What's going wrong here, how to fix it? </pre> </blockquote> <pre wrap=""> Hello, this might have multiple reasons. Please walk step-by-step through following page: <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/Troubleshooting#DNSSEC_signing_does_not_work">http://www.freeipa.org/page/Troubleshooting#DNSSEC_signing_does_not_work</a> Additional questions: * What version of FreeIPA and on what platform do you use? * Is the zone signed on DNSSEC key master or on replica? Does it work on one FreeIPA server but not on some other server? * Did you change something lately? </pre> </blockquote> </body> </html>