0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - Copyright (C) 2013-2016 Internet Systems Consortium, Inc. ("ISC")
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - file, You can obtain one at http://mozilla.org/MPL/2.0/.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<!-- Converted by db4-upgrade version 1.0 -->
83a28ca274521e15086fc39febde507bcc4e145eMark Andrews<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-importkey">
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <refentryinfo>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </refentryinfo>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <refentrytitle><application>dnssec-importkey</application></refentrytitle>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <refnamediv>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <refname><application>dnssec-importkey</application></refname>
f02194c0538094556090ded7964df2b72771d85eJeremy C. Reed <refpurpose>import DNSKEY records from external systems so they can be managed</refpurpose>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </refnamediv>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </copyright>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <refsynopsisdiv>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-h</option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-V</option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="req" rep="norepeat"><option>keyfile</option></arg>
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews </cmdsynopsis>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="req" rep="norepeat"><option>-f <replaceable class="parameter">filename</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-h</option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>-V</option></arg>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg choice="opt" rep="norepeat"><option>dnsname</option></arg>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </cmdsynopsis>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </refsynopsisdiv>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <refsection><info><title>DESCRIPTION</title></info>
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews reads a public DNSKEY record and generates a pair of
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews .key/.private files. The DNSKEY record may be read from an
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews existing .key file, in which case a corresponding .private file
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews will be generated, or it may be read from any other file or
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews from the standard input, in which case both .key and .private
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews files will be generated.
6ce1aa190246d65eb9dbcf0d29960f2773e3ab41Evan Hunt The newly-created .private file does <emphasis>not</emphasis>
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews contain private key data, and cannot be used for signing.
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews However, having a .private file makes it possible to set
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews (<option>-D</option>) times for the key, which means the
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews public key can be added to and removed from the DNSKEY RRset
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews on schedule even if the true private key is stored offline.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <variablelist>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <term>-f <replaceable class="parameter">filename</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Zone file mode: instead of a public keyfile name, the argument
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews is the DNS domain name of a zone master file, which can be read
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews from <option>file</option>. If the domain name is the same as
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews If <option>file</option> is set to <literal>"-"</literal>, then
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews the zone data is read from the standard input.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <term>-K <replaceable class="parameter">directory</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Sets the directory in which the key files are to reside.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <term>-L <replaceable class="parameter">ttl</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Sets the default TTL to use for this key when it is converted
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews into a DNSKEY RR. If the key is imported into a zone,
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews this is the TTL that will be used for it, unless there was
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews already a DNSKEY RRset in place, in which case the existing TTL
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews would take precedence. Setting the default TTL to
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <literal>0</literal> or <literal>none</literal> removes it.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Emit usage message and exit.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <term>-v <replaceable class="parameter">level</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Sets the debugging level.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </varlistentry>
42782931073786f98d3d0a617351db40066949a4Mukund Sivaraman <varlistentry>
42782931073786f98d3d0a617351db40066949a4Mukund Sivaraman Prints version information.
42782931073786f98d3d0a617351db40066949a4Mukund Sivaraman </varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </variablelist>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <refsection><info><title>TIMING OPTIONS</title></info>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews If the argument begins with a '+' or '-', it is interpreted as
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews an offset from the present time. For convenience, if such an offset
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews then the offset is computed in years (defined as 365 24-hour days,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews ignoring leap years), months (defined as 30 24-hour days), weeks,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews days, hours, or minutes, respectively. Without a suffix, the offset
a165a17a81ff3285f4f4d79785fafb465e626183Evan Hunt is computed in seconds. To explicitly prevent a date from being
a165a17a81ff3285f4f4d79785fafb465e626183Evan Hunt set, use 'none' or 'never'.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <variablelist>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <term>-P <replaceable class="parameter">date/offset</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Sets the date on which a key is to be published to the zone.
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews After that date, the key will be included in the zone but will
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews not be used to sign it.
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews </varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <term>-P sync <replaceable class="parameter">date/offset</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Sets the date on which CDS and CDNSKEY records that match this
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews key are to be published to the zone.
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews </varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <term>-D <replaceable class="parameter">date/offset</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Sets the date on which the key is to be deleted. After that
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews date, the key will no longer be included in the zone. (It
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews may remain in the key repository, however.)
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <varlistentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <term>-D sync <replaceable class="parameter">date/offset</replaceable></term>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews Sets the date on which the CDS and CDNSKEY records that match
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews this key are to be deleted.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </varlistentry>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </variablelist>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews A keyfile can be designed by the key identification
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews <filename>Knnnn.+aaa+iiiii</filename> or the full file name
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews <filename>Knnnn.+aaa+iiiii.key</filename> as generated by
6b0434299b05b6ca05c6836b9e8fbb7e67f05fb8Mark Andrews <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </citerefentry>,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <citerefentry>
e939674d53a127ddeeaf4b41fd72933f0b493308Mark Andrews <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews </citerefentry>,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt </refsection>