Innovatieblog -Innovation Blog - resilience

In a previous article we discussed the idea of a high-availability Hardware Security Module (or HSM) service. To make the entire DNSSEC signing service act in high-availability mode there is one more part to replicate, namely the OpenDNSSEC signer machines. These manage the... Read More »

When you start to support DNSSEC, you are suddenly supposed to manage the keys used to sign the domain. This is a typical task for a security officer. Typical concerns are to conceal the private keys from outside-world prying eyes, and to avoid losing keys as long as the outside... Read More »

Our signing architecture constitutes of redundant signers, connecting redundantly to redundant HSMs. Without redundancy, a situation could occur where domains disappear from the internet due to signatures that are not updated in time. Read More »