RRSIG mismatch

[bortzmeyer]

I have this in the log:

 Keyset command '/home/cascade/.cargo/bin/dnst keyset -c /var/db/cascade/keys/internautique.fr.cfg cron' stderr: [/home/cascade/.cargo/bin/dnst] WARN: RRSIG mismatch for internautique.fr/TXT: found {(SecurityAlgorithm::ED25519, 54162)} expected {(SecurityAlgorithm::ED25519, 63957)}

I don't know if it is serious or not?

[Philip-NLnetLabs]

This is normal for an automatic key roll. The key manager logs which record it found in the zone that has not been signed with the right key. The key manager will wait until all records have been signed correctly.

Cascade signs the zone incrementally, so during a key roll some records may be signed with the new key while others are still signed with the old key.

It becomes an issue if this situation persists beyond the time it normally takes to resign the entire zone. But it is still safe. It is just that the key roll will be stuck until the issue is resolved.

[bortzmeyer]

This is normal for an automatic key roll.

OK, but the text, with the WARN in uppercase, is a bit frightening.

[Philip-NLnetLabs]

I'll look into improving this text.