dnssec-dsfromkey.html revision 6f1205897504b8f50b1785975482c995888dd630
80833bb9a1bf25dcf19e814438a4b311d2e1f4cffuankg - Copyright (C) 2008-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - Permission to use, copy, modify, and/or distribute this software for any
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - purpose with or without fee is hereby granted, provided that the above
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - copyright notice and this permission notice appear in all copies.
4da61833a1cbbca94094f9653fd970582b97a72etrawick - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
4da61833a1cbbca94094f9653fd970582b97a72etrawick - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
4da61833a1cbbca94094f9653fd970582b97a72etrawick - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
4da61833a1cbbca94094f9653fd970582b97a72etrawick - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
4da61833a1cbbca94094f9653fd970582b97a72etrawick - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
4789804be088bcd86ae637a29cdb7fda25169521jailletc - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
4789804be088bcd86ae637a29cdb7fda25169521jailletc - PERFORMANCE OF THIS SOFTWARE.
4789804be088bcd86ae637a29cdb7fda25169521jailletc<!-- $Id$ -->
e50c3026198fd496f183cda4c32a202925476778covener<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrin<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
6c3b9cebb551140fbb25d58bae08b539b3802133ylavic<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
6c3b9cebb551140fbb25d58bae08b539b3802133ylavic<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavic<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
69301145375a889e7e37caf7cc7321ac0f91801erpluem<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
69301145375a889e7e37caf7cc7321ac0f91801erpluem<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
69301145375a889e7e37caf7cc7321ac0f91801erpluem<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
506bfe33206b2fece40ef25f695af39dd4130facjkaluza<p><span><strong class="command">dnssec-dsfromkey</strong></span>
d58a848a016d401b965111e50ef829e1641f7834minfrin outputs the Delegation Signer (DS) resource record (RR), as defined in
d58a848a016d401b965111e50ef829e1641f7834minfrin RFC 3658 and RFC 4509, for the given key(s).
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic Use SHA-1 as the digest algorithm (the default is to use
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic both SHA-1 and SHA-256).
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic Use SHA-256 as the digest algorithm.
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic Select the digest algorithm. The value of
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic SHA-256 (SHA256), GOST or SHA-384 (SHA384).
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener These values are case insensitive.
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener Specifies the TTL of the DS records.
44ff304057225e944e220e981d434a046d14cf06covener<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
44ff304057225e944e220e981d434a046d14cf06covener Look for key files (or, in keyset mode,
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand Zone file mode: in place of the keyfile name, the argument is
caad2986f81ab263f7af41467dd622dc9add17f3ylavic the DNS domain name of a zone master file, which can be read
caad2986f81ab263f7af41467dd622dc9add17f3ylavic from <code class="option">file</code>. If the zone name is the same as
caad2986f81ab263f7af41467dd622dc9add17f3ylavic <code class="option">file</code>, then it may be omitted.
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton the zone data is read from the standard input. This makes it
2165214331e4afafca4048f66f303d0253d7b001covener possible to use the output of the <span><strong class="command">dig</strong></span>
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem command as input, as in:
1e2d421a36999d292042a5539971070d54aa6c63ylavic <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
0b67eb8568cd58bb77082703951679b42cf098actrawick Include ZSK's when generating DS records. Without this option,
0b67eb8568cd58bb77082703951679b42cf098actrawick only keys which have the KSK flag set will be converted to DS
0b67eb8568cd58bb77082703951679b42cf098actrawick records and printed. Useful only in zone file mode.
5ef3c61605a3a021ff71f488983cb0065f8e1a79covener<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
09c87c777bed1655621bb20e1c46cb6b1a63279dcovener Generate a DLV set instead of a DS set. The specified
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavic <code class="option">domain</code> is appended to the name for each
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavic record in the set.
3060ce7f798fbda7999cd4ddf89b525d2b294185covener The DNSSEC Lookaside Validation (DLV) RR is described
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic in RFC 4431.
e6b4bd1113567627ab6bb6c6a7105e1e01a7d889jailletc Keyset mode: in place of the keyfile name, the argument is
e466c40e1801982602ee0200c9e8b61cc148742djailletc the DNS domain name of a keyset file.
457468b82e59d01eba00dd9d0817309c8f5e414ejim<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
457468b82e59d01eba00dd9d0817309c8f5e414ejim Specifies the DNS class (default is IN). Useful only
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton in keyset or zone file mode.
15890c9306ba98f6fc243e15a3c4778ddc7d773erpluem<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
15660979a30d251681463de2e0584853890082accovener Sets the debugging level.
cfd9415521847b2f9394fad04fb701cfb955f503rjung Prints usage information.
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe Prints version information.
49dacedb6c387b786b7911082ff35121a45f414bcovener To build the SHA-256 DS RR from the
49dacedb6c387b786b7911082ff35121a45f414bcovener <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
49dacedb6c387b786b7911082ff35121a45f414bcovener keyfile name, the following command would be issued:
3c990331fc6702119e4f5b8ba9eae3021aea5265jim<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
3c990331fc6702119e4f5b8ba9eae3021aea5265jim The command would print something like:
fc42512879dd0504532f52fe5d0d0383dda96a1eniq<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
983528026996668ea295be95aedb9c7a346af470ylavic The keyfile can be designed by the key identification
da0442c0440caef34706e2c2f3af05cb65921cc0jailletc <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
da0442c0440caef34706e2c2f3af05cb65921cc0jailletc <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
06b8f183140c8e02e0974e938a05078b511d1603covener <span class="refentrytitle">dnssec-keygen</span>(8).
15890c9306ba98f6fc243e15a3c4778ddc7d773erpluem The keyset file name is built from the <code class="option">directory</code>,
259878293a997ff49f5ddfc53d3739cbdc25444ecovener the string <code class="filename">keyset-</code> and the
b54b024c06a19926832d77d40ba35ad8c41e4d3dminfrin A keyfile error can give a "file not found" even if the file exists.
8152945ae46857b170cb227e79bb799f4fc7710dminfrin<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
8152945ae46857b170cb227e79bb799f4fc7710dminfrin <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
8152945ae46857b170cb227e79bb799f4fc7710dminfrin <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawick<p><span class="corpauthor">Internet Systems Consortium</span>