Skip to main content

​
Inline signing in BIND

BIND 9.9 introduces a new inline-signing option, which allows named, the name daemon on Linux, to sign zones completely transparently. A server can load or transfer an unsigned zone and create a signed version that answers all queries and transfer requests without altering the original unsigned version. As you update the unsigned zone, named detects the changes you made and applies those changes to the signed version. This enables a seamless transition to DNSSEC with minimal disruption to existing systems. This integration guide provides a basic example of configuring BIND 9 to integrate with the CryptoHub for private key storage and signing of zone files. If you want to implement inline signing in BIND, refer to the following Inline Signing article on the ISC knowledgebase website.

Related topics

Inline Signing with BINDBINDValidate and testValidation and TestingBind the certificate in IIS