TSIG key management
Overview
This guide provides detailed instructions for TSIG key management, covering both targeted and comprehensive actions.
Targeted actions include:
Comprehensive actions include listing all available TSIG keys.
Benefits
TSIG key management safeguards the integrity and security of DNS communications. By signing each transaction with a unique key, DigiCert® DNS ensures trusted, authenticated interactions that meet regulatory and compliance requirements. The platform enables cryptographic authentication for DNS transactions, allowing only authorized parties to initiate updates or transfers. Support for dynamic DNS updates and secure zone transfers automates critical changes and protects data in transit. Centralized management provides fine-grained access control and full visibility, reducing unauthorized changes, simplifying troubleshooting, and improving system reliability.
Procedures
Aviso
This procedure creates a TSIG key (tsigkey) that will be updated and deleted in subsequent procedures. To apply this TSIG key, follow the procedure for updating the settings of a primary domain or a secondary domain.
To test this function, call this API endpoint: POST /tsig
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Configurations.
In the TSIG KEYS tab, select the Add TSIG Key button.
In the Add TSIG Key dialog:
Enter a name in the Name field (for example, tsigkey).
From the Algorithm drop-down list, select a type:
HMAC-SHA224: Ideal for environments with strict size constraints or legacy systems requiring shorter digest lengths.
HMAC-SHA256: Ideal for general-purpose use, offering a strong balance of performance and security; widely supported and recommended for most configurations.
HMAC-SHA384: Ideal for systems requiring a higher security level than SHA256, with slightly increased computational overhead.
HMAC-SHA512: Ideal for high-security environments where maximum integrity and collision resistance are required, especially in modern systems with sufficient processing capacity.
In the Secret field, enter a secret key manually or select Auto-Generate Key to create one automatically.
Sugerencia
Selecting Auto-Generate Key will either populate an empty field or replace an existing secret key. You can auto-generate as often as needed; however, if the algorithm type is changed, a new secret key must be provided.
Select Save to finish.
A message appears confirming the successful creation of the TSIG key.
Aviso
This procedure deletes a specific TSIG key (tsigkey) created in an earlier procedure. You can follow either Path 1 or Path 2 to complete the deletion.
To test this function, call this API endpoint: DELETE /tsig/{tsigId}
Path 1
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Configurations.
In the TSIG KEYS tab, at the end of the row of the TSIG key you want to delete, select the trash icon.
In the Confirm Deletion dialog, select Confirm.
A message appears confirming the successful deletion of the TSIG key.
Path 2
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Configurations.
In the TSIG KEYS tab, select the checkbox of the TSIG key you want to delete.
Sugerencia
You can select multiple checkboxes to delete several TSIG keys at once.
Select Delete at the top of the table.
In the Confirm Deletion dialog, select Confirm.
A message appears confirming the successful deletion of the TSIG key.
Aviso
This procedure displays all TSIG keys created by the user.
To test this function, call this API endpoint: GET /tsig
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Configurations.
Select the TSIG KEYS tab.
The table displays all the TSIG keys associated with the account.
Sugerencia
Use Columns and Filters to customize your view of the results.
Aviso
This procedure displays the details of a specific TSIG key (tsigkey) created in an earlier procedure. Follow Path 1 if there are only a few results to review. Follow Path 2 if you prefer to filter results quickly.
To test this function, call this API endpoint: GET /tsig/{tsigId}
Path 1
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Configurations.
Select the TSIG KEYS tab.
The table displays all the TSIG keys associated with the account.
Locate the TSIG key you want to view (for example, tsigkey).
Select Columns at the top of the results table, then select all the checkboxes to ensure that all TSIG key information is displayed.
Path 2
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Configurations.
Select the TSIG KEYS tab.
The table displays all the TSIG keys associated with the account.
Select Filters at the top of the results table to locate the specific TSIG key quickly.
Sugerencia
In this example, the name of the TSIG key is known, so the following filter was applied:
Under Column, select Name.
Under Operator, select contains.
Under Value, enter the TSIG key's name (tsigkey).
If no results appear, double-check the Filters selections and input values.
Select Columns at the top of the results table, then select all the checkboxes to ensure that all TSIG key information is displayed.
Aviso
This procedure updates a specific TSIG key (tsigkey) created in an earlier procedure.
To test this function, call this API endpoint: PUT /tsig/{tsigId}
Sign in to your DigiCert® DNS account.
From the landing page, go to the left sidebar and select DNS > Configurations.
Select the TSIG KEYS tab.
The table displays all the TSIG keys associated with the account.
Locate the TSIG key you want to update - see Path 2 for quick filtering.
Select the name of the TSIG key (for example, tsigkey).
In the Edit TSIG Key dialog:
Edit the TSIG key's details as required.
Sugerencia
Selecting Auto-Generate Key will replace the existing secret key. You can auto-generate as often as needed; however, if the algorithm type is changed, a new secret key must be provided.
Select Save to finish.
A message appears confirming the successful update of the TSIG key.