DNSKEYusing algorithm 8 (RSA/SHA-256) has a size (1024) smaller than the recommended one (2048)

[Olivier69]

Hello,

I set DNSSEC in Direct Admin, report it in my registrar's DS records, no problem, but when i make https://zonemaster.fr/domain_check , i get this message "DNSKEY with tag 38718 and using algorithm 8 (RSA/SHA-256) has a size (1024) smaller than the recommended one (2048)".

Could you please upgrade this in DA ?

Thanks

 

[factor]

Make your request here.

DirectAdmin Feedback

feedback.directadmin.com

It looks like the current dnssec.sh only does sha256. Thanks

 

[Richard G]

I have this only on part 17 and 18 of that check.
However if you give me the link to your feature request on upvoty where Brent pointed to, I will upvote it for you.

 

[DirectAdmin Support]

I've added a new flag to the top of the dnssec.sh script:

KEY_BIT_SIZE=2048

Now both the zsk and ksk keys will be 2048 bit.
Pre-release binaries available in about 5 minutes.

John

 

[factor]

John thanks

 

[Olivier69]

I've added a new flag to the top of the dnssec.sh script:

KEY_BIT_SIZE=2048

Now both the zsk and ksk keys will be 2048 bit.
Pre-release binaries available in about 5 minutes.

John

Cool, thanks

 

[Richard G]

Now both the zsk and ksk keys will be 2048 bit.

Thank you. Will this work automatically or do we have to re-use the dnssec.sh script for it to work?
And if yes, won't this change current keys?