[Dnssec-deployment] Signatures in KG zone have premature start times

[Casey Deccio]

On Tue, Feb 22, 2011 at 6:08 AM, Chris Thompson <cet1 at cam.ac.uk> wrote:
>
> On Feb 22 2011, Stephane Bortzmeyer wrote:
>
>> On Tue, Feb 22, 2011 at 12:57:37PM +0000,
>> Chris Thompson <cet1 at cam.ac.uk> wrote a message of 13 lines which said:
>>
>>> The start times on the signatures are all 2011-02-22 17:10:02 UTC,
>>> still several hours in the future.
>>
>> Since Kyrgyzstan is UTC+6, it is not too difficult to see where does
>> the bug come from...
>
> Well, possibly. There was similar speculation about the TH timeslip
> on 2010-11-13, but I don't think we were ever told what had actually
> caused that one.
>

This one is different.  It's been occurring for at least 24 hours, but
it hasn't been a one-time event.  The RRSIGs have been "renewed"
periodically since it started, each time with an inception date still
in the future.  What we're seeing is simply the latest occurrence.
There is something wrong with the setup/maintenance of the .kg zone.

Casey