TechnitiumSoftware/DnsServer · error · NotSupportedException

Automatic rollover is not supported for Key Signing Keys…

Error message

Automatic rollover is not supported for Key Signing Keys (KSK).

What it means

Thrown by RolloverDays setter when _keyType is not ZoneSigningKey (i.e. it is a Key Signing Key, KSK) and the value is non-zero. Automatic rollover is implemented only for ZSKs because KSK rollover has a parent-side DS coordination step this code path does not handle; any non-zero value on a KSK is therefore rejected.

Solutions

1. Do not set RolloverDays on a KSK; automatic rollover is ZSK-only. Leave it at 0.
2. For KSK rollover use the manual DNSSEC rollover workflow (DS coordination) provided by the DNSSEC API.
3. In bulk key-config code, branch on key type and only assign RolloverDays for ZoneSigningKey.

Example fix

// before
foreach (var k in keys) k.RolloverDays = 30; // includes KSK

// after
foreach (var k in keys)
    if (k.KeyType == DnssecPrivateKeyType.ZoneSigningKey)
        k.RolloverDays = 30;
    else
        k.RolloverDays = 0; // KSK: rollover not supported

if (key.KeyType == DnssecPrivateKeyType.ZoneSigningKey)
    key.RolloverDays = (ushort)days;
else if (days != 0)
    throw new NotSupportedException("Automatic rollover is ZSK-only; use manual KSK rollover.");

static bool SupportsAutoRollover(DnssecPrivateKey k) =>
    k.KeyType == DnssecPrivateKeyType.ZoneSigningKey;

try { key.RolloverDays = (ushort)days; }
catch (NotSupportedException ex) when (ex.Message.Contains("Key Signing Keys"))
{ /* KSK: leave RolloverDays at 0 */ }

When it happens

Trigger: Assigning key.RolloverDays = N (N != 0) on a key whose _keyType == DnssecPrivateKeyType.KeySigningKey. The 0 case is explicitly allowed so serializers can write the default without error.

Common situations: Config restore or API call sets the same RolloverDays value on every DNSSEC key including the KSK; operator picks the KSK row in the UI and enables auto-rollover.

Related errors

• Cannot activate private key: no such private key was found.
• Zone Signing Key (ZSK) automatic rollover days valid range…
• Cannot add DNSSEC record.
• Cannot add record: disabling records in a signed zones is…
• Cannot convert to NSEC3: the zone must be signed with NSEC…

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/df84423eab9e0094. Report an issue: GitHub.

Appendix: source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:458

                    switch (_state)
                    {
                        case DnssecPrivateKeyState.Generated:
                        case DnssecPrivateKeyState.Published:
                        case DnssecPrivateKeyState.Ready:
                        case DnssecPrivateKeyState.Active:
                            if (_isRetiring)
                                throw new InvalidOperationException("Zone Signing Key (ZSK) automatic rollover cannot be set since it is set to retire.");

                            break;

                        default:
                            throw new InvalidOperationException("Zone Signing Key (ZSK) automatic rollover cannot be set due to invalid key state.");
                    }
                }
                else
                {
                    if (value != 0)
                        throw new NotSupportedException("Automatic rollover is not supported for Key Signing Keys (KSK).");
                }

                _rolloverDays = value;
            }
        }

        public DnsDNSKEYRecordData DnsKey
        { get { return _dnsKey; } }

        public ushort KeyTag
        { get { return _dnsKey.ComputedKeyTag; } }

        #endregion
    }
}

View on GitHub (pinned to d0484b6c1e)