DNSSEC validating resolver on machines without RTC or wrong date
sca at andreasschulze.de
Sun Apr 16 14:05:52 UTC 2023
Am 16.04.23 um 00:48 schrieb Petr Menšík via Unbound-users:
> I maintain unbound on Fedora and RHEL. I met some question on some Fedora channel about problems with NTP service. It turned out the problem of that user lied were in DNSSEC validating resolver and wrong time on his machine. Like significantly wrong date, which made DNSSEC validation fail because some timestamp on RRSIG did not fail.
this scenario is also mentioned in RFC 8027  with the same options to solve that:
- DNSSEC depend on correct time. If the local time is wrong the system startup will fail -> to be fixed by a human
- disable DNSSEC validation until the system hat a correct time -> it's convenient for the user but hard for you as implementer.
I personally prefer the first option.
More information about the Unbound-users