0N/A - Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC") 0N/A - Permission to use, copy, modify, and/or distribute this software for any 0N/A - purpose with or without fee is hereby granted, provided that the above 0N/A - copyright notice and this permission notice appear in all copies. 0N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 0N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 0N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 0N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 0N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 0N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 0N/A - PERFORMANCE OF THIS SOFTWARE. 0N/A<!-- Converted by db4-upgrade version 1.0 --> 0N/A <
date>2012-05-02</
date>
0N/A <
corpname>ISC</
corpname>
0N/A <
corpauthor>Internet Systems Consortium, Inc.</
corpauthor>
0N/A <
refentrytitle><
application>dnssec-dsfromkey</
application></
refentrytitle>
0N/A <
manvolnum>8</
manvolnum>
0N/A <
refmiscinfo>BIND9</
refmiscinfo>
0N/A <
refname><
application>dnssec-dsfromkey</
application></
refname>
0N/A <
refpurpose>DNSSEC DS RR generation tool</
refpurpose>
0N/A <
holder>Internet Systems Consortium, Inc. ("ISC")</
holder>
0N/A <
cmdsynopsis sepchar=" ">
0N/A <
command>dnssec-dsfromkey</
command>
0N/A <
arg choice="opt" rep="norepeat"><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-1</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-2</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-a <
replaceable class="parameter">alg</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-C</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-l <
replaceable class="parameter">domain</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-T <
replaceable class="parameter">TTL</
replaceable></
option></
arg>
0N/A <
arg choice="req" rep="norepeat">keyfile</
arg>
0N/A <
cmdsynopsis sepchar=" ">
0N/A <
command>dnssec-dsfromkey</
command>
0N/A <
arg choice="req" rep="norepeat">-s</
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-1</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-2</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-a <
replaceable class="parameter">alg</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-K <
replaceable class="parameter">directory</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-l <
replaceable class="parameter">domain</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-s</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-c <
replaceable class="parameter">class</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-T <
replaceable class="parameter">TTL</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-f <
replaceable class="parameter">file</
replaceable></
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-A</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
0N/A <
arg choice="req" rep="norepeat">dnsname</
arg>
0N/A <
cmdsynopsis sepchar=" ">
0N/A <
command>dnssec-dsfromkey</
command>
0N/A <
arg choice="opt" rep="norepeat"><
option>-h</
option></
arg>
0N/A <
arg choice="opt" rep="norepeat"><
option>-V</
option></
arg>
0N/A <
refsection><
info><
title>DESCRIPTION</
title></
info>
0N/A <
para><
command>dnssec-dsfromkey</
command>
0N/A outputs the Delegation Signer (DS) resource record (RR), as defined in
0N/A RFC 3658 and RFC 4509, for the given key(s).
0N/A <
refsection><
info><
title>OPTIONS</
title></
info>
0N/A Use SHA-1 as the digest algorithm (the default is to use
0N/A both SHA-1 and SHA-256).
0N/A Use SHA-256 as the digest algorithm.
0N/A <
term>-a <
replaceable class="parameter">algorithm</
replaceable></
term>
0N/A Select the digest algorithm. The value of
0N/A <
option>algorithm</
option> must be one of SHA-1 (SHA1),
0N/A SHA-256 (SHA256), GOST or SHA-384 (SHA384).
0N/A These values are case insensitive.
0N/A Generate CDS records rather than DS records. This is mutually
0N/A exclusive with generating lookaside records.
0N/A <
term>-T <
replaceable class="parameter">TTL</
replaceable></
term>
0N/A Specifies the TTL of the DS records.
0N/A <
term>-K <
replaceable class="parameter">directory</
replaceable></
term>
0N/A Look for key files (or, in keyset mode,
0N/A <
filename>keyset-</
filename> files) in
0N/A <
option>directory</
option>.
0N/A <
term>-f <
replaceable class="parameter">file</
replaceable></
term>
0N/A Zone file mode: in place of the keyfile name, the argument is
0N/A the DNS domain name of a zone master file, which can be read
0N/A from <
option>file</
option>. If the zone name is the same as
0N/A <
option>file</
option>, then it may be omitted.
0N/A If <
option>file</
option> is set to <
literal>"-"</
literal>, then
0N/A the zone data is read from the standard input. This makes it
0N/A possible to use the output of the <
command>dig</
command>
0N/A command as input, as in:
0N/A Include ZSKs when generating DS records. Without this option,
0N/A only keys which have the KSK flag set will be converted to DS
0N/A records and printed. Useful only in zone file mode.
0N/A <
term>-l <
replaceable class="parameter">domain</
replaceable></
term>
0N/A Generate a DLV set instead of a DS set. The specified
0N/A <
option>domain</
option> is appended to the name for each
0N/A The DNSSEC Lookaside Validation (DLV) RR is described
0N/A in RFC 4431. This is mutually exclusive with generating
0N/A Keyset mode: in place of the keyfile name, the argument is
0N/A the DNS domain name of a keyset file.
0N/A <
term>-c <
replaceable class="parameter">class</
replaceable></
term>
0N/A Specifies the DNS class (default is IN). Useful only
0N/A in keyset or zone file mode.
0N/A <
term>-v <
replaceable class="parameter">level</
replaceable></
term>
0N/A Sets the debugging level.
0N/A Prints usage information.
0N/A Prints version information.
0N/A <
refsection><
info><
title>EXAMPLE</
title></
info>
0N/A To build the SHA-256 DS RR from the
0N/A keyfile name, the following command would be issued:
0N/A The command would print something like:
0N/A <
para><
userinput>
example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</
userinput>
0N/A <
refsection><
info><
title>FILES</
title></
info>
0N/A The keyfile can be designed by the key identification
0N/A <
filename>Knnnn.+aaa+iiiii</
filename> or the full file name
0N/A <
refentrytitle>dnssec-keygen</
refentrytitle><
manvolnum>8</
manvolnum>.
0N/A The keyset file name is built from the <
option>directory</
option>,
0N/A the string <
filename>keyset-</
filename> and the
0N/A <
option>dnsname</
option>.
0N/A <
refsection><
info><
title>CAVEAT</
title></
info>
0N/A A keyfile error can give a "file not found" even if the file exists.
0N/A <
refsection><
info><
title>SEE ALSO</
title></
info>
0N/A <
para><
citerefentry>
0N/A <
refentrytitle>dnssec-keygen</
refentrytitle><
manvolnum>8</
manvolnum>
0N/A <
refentrytitle>dnssec-signzone</
refentrytitle><
manvolnum>8</
manvolnum>
0N/A <
citetitle>BIND 9 Administrator Reference Manual</
citetitle>,
0N/A <
citetitle>RFC 3658</
citetitle>,
0N/A <
citetitle>RFC 4431</
citetitle>.
0N/A <
citetitle>RFC 4509</
citetitle>.