TechnitiumSoftware/DnsServer · error · NotSupportedException

Automatic rollover is not supported for Key Signing Keys (KS

Error message

Automatic rollover is not supported for Key Signing Keys (KSK).

What it means

Thrown by RolloverDays setter when _keyType is not ZoneSigningKey (i.e. it is a Key Signing Key, KSK) and the value is non-zero. Automatic rollover is implemented only for ZSKs because KSK rollover has a parent-side DS coordination step this code path does not handle; any non-zero value on a KSK is therefore rejected.

Source

Thrown at DnsServerCore/Dns/Dnssec/DnssecPrivateKey.cs:458

                    switch (_state)
                    {
                        case DnssecPrivateKeyState.Generated:
                        case DnssecPrivateKeyState.Published:
                        case DnssecPrivateKeyState.Ready:
                        case DnssecPrivateKeyState.Active:
                            if (_isRetiring)
                                throw new InvalidOperationException("Zone Signing Key (ZSK) automatic rollover cannot be set since it is set to retire.");

                            break;

                        default:
                            throw new InvalidOperationException("Zone Signing Key (ZSK) automatic rollover cannot be set due to invalid key state.");
                    }
                }
                else
                {
                    if (value != 0)
                        throw new NotSupportedException("Automatic rollover is not supported for Key Signing Keys (KSK).");
                }

                _rolloverDays = value;
            }
        }

        public DnsDNSKEYRecordData DnsKey
        { get { return _dnsKey; } }

        public ushort KeyTag
        { get { return _dnsKey.ComputedKeyTag; } }

        #endregion
    }
}

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Do not set RolloverDays on a KSK; automatic rollover is ZSK-only. Leave it at 0.
2. For KSK rollover use the manual DNSSEC rollover workflow (DS coordination) provided by the DNSSEC API.
3. In bulk key-config code, branch on key type and only assign RolloverDays for ZoneSigningKey.

Example fix

// before
foreach (var k in keys) k.RolloverDays = 30; // includes KSK

// after
foreach (var k in keys)
    if (k.KeyType == DnssecPrivateKeyType.ZoneSigningKey)
        k.RolloverDays = 30;
    else
        k.RolloverDays = 0; // KSK: rollover not supported

if (key.KeyType == DnssecPrivateKeyType.ZoneSigningKey)
    key.RolloverDays = (ushort)days;
else if (days != 0)
    throw new NotSupportedException("Automatic rollover is ZSK-only; use manual KSK rollover.");

static bool SupportsAutoRollover(DnssecPrivateKey k) =>
    k.KeyType == DnssecPrivateKeyType.ZoneSigningKey;

try { key.RolloverDays = (ushort)days; }
catch (NotSupportedException ex) when (ex.Message.Contains("Key Signing Keys"))
{ /* KSK: leave RolloverDays at 0 */ }

When it happens

Trigger: Assigning key.RolloverDays = N (N != 0) on a key whose _keyType == DnssecPrivateKeyType.KeySigningKey. The 0 case is explicitly allowed so serializers can write the default without error.

Common situations: Config restore or API call sets the same RolloverDays value on every DNSSEC key including the KSK; operator picks the KSK row in the UI and enables auto-rollover.

Related errors

• Zone Signing Key (ZSK) automatic rollover days valid range i
• Cannot activate private key: no such private key was found.
• Valid RSA ({(keyType == DnssecPrivateKeyType.KeySigningKey ?
• Failed to sign record set: {extendedDnsErrorCode}
• Zone Signing Key (ZSK) automatic rollover cannot be set sinc

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/df84423eab9e0094. Report an issue: GitHub.