dnssec-dsfromkey.docbook revision edad003e630cf9a25db88d95247d10eb96117d66
0N/A<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
0N/A "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
0N/A [<!ENTITY mdash "&#8212;">]>
0N/A<!--
0N/A - Copyright (C) 2008-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
0N/A -
0N/A - Permission to use, copy, modify, and/or distribute this software for any
0N/A - purpose with or without fee is hereby granted, provided that the above
0N/A - copyright notice and this permission notice appear in all copies.
0N/A -
0N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
0N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
0N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
0N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
0N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
0N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
0N/A - PERFORMANCE OF THIS SOFTWARE.
0N/A-->
873N/A
0N/A<refentry id="man.dnssec-dsfromkey">
0N/A <refentryinfo>
0N/A <date>May 02, 2012</date>
0N/A </refentryinfo>
0N/A
868N/A <refmeta>
0N/A <refentrytitle><application>dnssec-dsfromkey</application></refentrytitle>
0N/A <manvolnum>8</manvolnum>
0N/A <refmiscinfo>BIND9</refmiscinfo>
0N/A </refmeta>
0N/A
0N/A <refnamediv>
0N/A <refname><application>dnssec-dsfromkey</application></refname>
1008N/A <refpurpose>DNSSEC DS RR generation tool</refpurpose>
0N/A </refnamediv>
0N/A
0N/A <docinfo>
0N/A <copyright>
0N/A <year>2008</year>
353N/A <year>2009</year>
0N/A <year>2010</year>
338N/A <year>2011</year>
0N/A <year>2012</year>
1400N/A <year>2014</year>
1400N/A <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
0N/A </copyright>
0N/A </docinfo>
0N/A
338N/A <refsynopsisdiv>
0N/A <cmdsynopsis>
0N/A <command>dnssec-dsfromkey</command>
0N/A <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
338N/A <arg><option>-1</option></arg>
0N/A <arg><option>-2</option></arg>
0N/A <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
0N/A <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
0N/A <arg><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
0N/A <arg choice="req">keyfile</arg>
338N/A </cmdsynopsis>
1008N/A <cmdsynopsis>
0N/A <command>dnssec-dsfromkey</command>
0N/A <arg choice="req">-s</arg>
1400N/A <arg><option>-1</option></arg>
1400N/A <arg><option>-2</option></arg>
1400N/A <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
1400N/A <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
1400N/A <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
0N/A <arg><option>-s</option></arg>
0N/A <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
0N/A <arg><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
0N/A <arg><option>-f <replaceable class="parameter">file</replaceable></option></arg>
0N/A <arg><option>-A</option></arg>
0N/A <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
0N/A <arg choice="req">dnsname</arg>
0N/A </cmdsynopsis>
0N/A <cmdsynopsis>
0N/A <command>dnssec-dsfromkey</command>
0N/A <arg><option>-h</option></arg>
0N/A <arg><option>-V</option></arg>
0N/A </cmdsynopsis>
0N/A </refsynopsisdiv>
338N/A
0N/A <refsect1>
338N/A <title>DESCRIPTION</title>
353N/A <para><command>dnssec-dsfromkey</command>
1008N/A outputs the Delegation Signer (DS) resource record (RR), as defined in
338N/A RFC 3658 and RFC 4509, for the given key(s).
0N/A </para>
0N/A </refsect1>
0N/A
0N/A <refsect1>
0N/A <title>OPTIONS</title>
1008N/A
0N/A <variablelist>
0N/A <varlistentry>
0N/A <term>-1</term>
0N/A <listitem>
0N/A <para>
0N/A Use SHA-1 as the digest algorithm (the default is to use
0N/A both SHA-1 and SHA-256).
0N/A </para>
0N/A </listitem>
0N/A </varlistentry>
1008N/A
0N/A <varlistentry>
0N/A <term>-2</term>
0N/A <listitem>
0N/A <para>
0N/A Use SHA-256 as the digest algorithm.
0N/A </para>
0N/A </listitem>
0N/A </varlistentry>
353N/A
0N/A <varlistentry>
0N/A <term>-a <replaceable class="parameter">algorithm</replaceable></term>
0N/A <listitem>
0N/A <para>
0N/A Select the digest algorithm. The value of
338N/A <option>algorithm</option> must be one of SHA-1 (SHA1),
0N/A SHA-256 (SHA256), GOST or SHA-384 (SHA384).
338N/A These values are case insensitive.
338N/A </para>
338N/A </listitem>
0N/A </varlistentry>
338N/A
338N/A <varlistentry>
338N/A <term>-T <replaceable class="parameter">TTL</replaceable></term>
0N/A <listitem>
338N/A <para>
338N/A Specifies the TTL of the DS records.
0N/A </para>
338N/A </listitem>
0N/A </varlistentry>
338N/A
338N/A <varlistentry>
0N/A <term>-K <replaceable class="parameter">directory</replaceable></term>
0N/A <listitem>
0N/A <para>
338N/A Look for key files (or, in keyset mode,
0N/A <filename>keyset-</filename> files) in
338N/A <option>directory</option>.
338N/A </para>
0N/A </listitem>
338N/A </varlistentry>
338N/A
338N/A <varlistentry>
353N/A <term>-f <replaceable class="parameter">file</replaceable></term>
338N/A <listitem>
338N/A <para>
868N/A Zone file mode: in place of the keyfile name, the argument is
868N/A the DNS domain name of a zone master file, which can be read
1400N/A from <option>file</option>. If the zone name is the same as
1400N/A <option>file</option>, then it may be omitted.
868N/A </para>
338N/A <para>
338N/A If <option>file</option> is set to <literal>"-"</literal>, then
338N/A the zone data is read from the standard input. This makes it
868N/A possible to use the output of the <command>dig</command>
868N/A command as input, as in:
1400N/A </para>
868N/A <para>
0N/A <userinput>dig dnskey example.com | dnssec-dsfromkey -f - example.com</userinput>
338N/A </para>
338N/A </listitem>
338N/A </varlistentry>
338N/A
338N/A <varlistentry>
338N/A <term>-A</term>
338N/A <listitem>
338N/A <para>
338N/A Include ZSKs when generating DS records. Without this option,
338N/A only keys which have the KSK flag set will be converted to DS
338N/A records and printed. Useful only in zone file mode.
338N/A </para>
0N/A </listitem>
338N/A </varlistentry>
0N/A
0N/A <varlistentry>
338N/A <term>-l <replaceable class="parameter">domain</replaceable></term>
338N/A <listitem>
0N/A <para>
0N/A Generate a DLV set instead of a DS set. The specified
338N/A <option>domain</option> is appended to the name for each
393N/A record in the set.
0N/A The DNSSEC Lookaside Validation (DLV) RR is described
0N/A in RFC 4431.
0N/A </para>
</listitem>
</varlistentry>
<varlistentry>
<term>-s</term>
<listitem>
<para>
Keyset mode: in place of the keyfile name, the argument is
the DNS domain name of a keyset file.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-c <replaceable class="parameter">class</replaceable></term>
<listitem>
<para>
Specifies the DNS class (default is IN). Useful only
in keyset or zone file mode.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-v <replaceable class="parameter">level</replaceable></term>
<listitem>
<para>
Sets the debugging level.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-h</term>
<listitem>
<para>
Prints usage information.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term>-V</term>
<listitem>
<para>
Prints version information.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>EXAMPLE</title>
<para>
To build the SHA-256 DS RR from the
<userinput>Kexample.com.+003+26160</userinput>
keyfile name, the following command would be issued:
</para>
<para><userinput>dnssec-dsfromkey -2 Kexample.com.+003+26160</userinput>
</para>
<para>
The command would print something like:
</para>
<para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</userinput>
</para>
</refsect1>
<refsect1>
<title>FILES</title>
<para>
The keyfile can be designed by the key identification
<filename>Knnnn.+aaa+iiiii</filename> or the full file name
<filename>Knnnn.+aaa+iiiii.key</filename> as generated by
<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
</para>
<para>
The keyset file name is built from the <option>directory</option>,
the string <filename>keyset-</filename> and the
<option>dnsname</option>.
</para>
</refsect1>
<refsect1>
<title>CAVEAT</title>
<para>
A keyfile error can give a "file not found" even if the file exists.
</para>
</refsect1>
<refsect1>
<title>SEE ALSO</title>
<para><citerefentry>
<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>,
<citerefentry>
<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
</citerefentry>,
<citetitle>BIND 9 Administrator Reference Manual</citetitle>,
<citetitle>RFC 3658</citetitle>,
<citetitle>RFC 4431</citetitle>.
<citetitle>RFC 4509</citetitle>.
</para>
</refsect1>
<refsect1>
<title>AUTHOR</title>
<para><corpauthor>Internet Systems Consortium</corpauthor>
</para>
</refsect1>
</refentry><!--
- Local variables:
- mode: sgml
- End:
-->