What does Error: multiple DS with keytag: 53376 mean

[emdee-is]

I got this error on kryptonit.org

INFO: validating answers
INFO: validating org DS with . DNSKEY
OK RRSIG (DS, RSASHA256) with DNSKEY (18733, RSASHA256)
INFO: validating . DNSKEY with . DS (trust anchor)
OK RRSIG (DNSKEY, RSASHA256) with DNSKEY (20326, RSASHA256)
OK DNSKEY (20326, RSASHA256) with DS (SHA-256)
INFO: validating org DNSKEY with org DS
OK RRSIG (DNSKEY, RSASHA256) with DNSKEY (26974, RSASHA256)
OK DNSKEY (26974, RSASHA256) with DS (SHA-256)
DBUG: validating kryptonit.org DNSKEY with kryptonit.org DS
OK RRSIG (DNSKEY, ECDSAP256SHA256) with DNSKEY (53376, ECDSAP256SHA256)
Error: multiple DS with keytag: 53376

I know it's a tool for experts, but documentation a few of the most common errors in the except: clauses of ___main__.py would help people like me who have never used DNSsec before.

It might also go in a testsuite to make sure you are raising errors on know bad domains.

[emdee-is]

Same with pineapple.cx

Error: RRSIG is not valid anymore

Does that mean expired?

[metebalci]

I think multiple DS with same keytag is clear enough but I should clarify "is not valid anymore".

I very much agree about having a full testsuite but it is difficult/time-consuming the generate such a testsuite, as the errors normally does not happen (DNS servers do these automatically), so probably it should be generated manually. Added #22 for this

[emdee-is]

I'm new at DNSsec so my question is even more basic:
is DS with same keytag good or bad?

Should keytags be unique?

Is in an indication that one keytag holder is impersonating another?

The set of test domains I use are suspected to be bad somehow.

[emdee-is]

Error: RRSIG is not valid anymore

Is that bad like an expired certificate? Is there an expiry date you can show?

[metebalci]

This is exactly my point, you need to know about DNSSEC to use this tool, or you should be learning about DNSSEC while using it e.g. while learning my blog post.

[metebalci]

Yes it is like an expired certificate. Fixed with ca4aed2