dnssec-importkey.docbook revision 14a656f94b1fd0ababd84a772228dfa52276ba15
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - Copyright (C) 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - Permission to use, copy, modify, and/or distribute this software for any
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - purpose with or without fee is hereby granted, provided that the above
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - copyright notice and this permission notice appear in all copies.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich - PERFORMANCE OF THIS SOFTWARE.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich<!-- Converted by db4-upgrade version 1.0 -->
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-importkey">
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refentryinfo>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refentryinfo>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refentrytitle><application>dnssec-importkey</application></refentrytitle>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refname><application>dnssec-importkey</application></refname>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refpurpose>Import DNSKEY records from external systems so they can be managed.</refpurpose>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refnamediv>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refsynopsisdiv>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
ecb0e3c0ca1489bc78b763cdfb6163c8c1043e2eAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
ecb0e3c0ca1489bc78b763cdfb6163c8c1043e2eAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-h</option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-V</option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="req" rep="norepeat"><option>keyfile</option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </cmdsynopsis>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="req" rep="norepeat"><option>-f <replaceable class="parameter">filename</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-h</option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>-V</option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <arg choice="opt" rep="norepeat"><option>dnsname</option></arg>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </cmdsynopsis>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refsynopsisdiv>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refsection><info><title>DESCRIPTION</title></info>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich reads a public DNSKEY record and generates a pair of
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich .key/.private files. The DNSKEY record may be read from an
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich existing .key file, in which case a corresponding .private file
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich will be generated, or it may be read from any other file or
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich from the standard input, in which case both .key and .private
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich files will be generated.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich The newly-created .private file does <emphasis>not</emphasis>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich contain private key data, and cannot be used for signing.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich However, having a .private file makes it possible to set
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich publication (<option>-P</option>) and deletion
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich (<option>-D</option>) times for the key, which means the
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich public key can be added to and removed from the DNSKEY RRset
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich on schedule even if the true private key is stored offline.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refsection>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refsection><info><title>OPTIONS</title></info>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <variablelist>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <term>-f <replaceable class="parameter">filename</replaceable></term>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Zone file mode: instead of a public keyfile name, the argument
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich is the DNS domain name of a zone master file, which can be read
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich from <option>file</option>. If the domain name is the same as
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <option>file</option>, then it may be omitted.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich If <option>file</option> is set to <literal>"-"</literal>, then
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich the zone data is read from the standard input.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <term>-K <replaceable class="parameter">directory</replaceable></term>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Sets the directory in which the key files are to reside.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <term>-L <replaceable class="parameter">ttl</replaceable></term>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Sets the default TTL to use for this key when it is converted
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich into a DNSKEY RR. If the key is imported into a zone,
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich this is the TTL that will be used for it, unless there was
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich already a DNSKEY RRset in place, in which case the existing TTL
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich would take precedence. Setting the default TTL to
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <literal>0</literal> or <literal>none</literal> removes it.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Emit usage message and exit.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <term>-v <replaceable class="parameter">level</replaceable></term>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Sets the debugging level.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Prints version information.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </variablelist>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refsection>
ecb0e3c0ca1489bc78b763cdfb6163c8c1043e2eAllen Rabinovich <refsection><info><title>TIMING OPTIONS</title></info>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich If the argument begins with a '+' or '-', it is interpreted as
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich an offset from the present time. For convenience, if such an offset
ecb0e3c0ca1489bc78b763cdfb6163c8c1043e2eAllen Rabinovich is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich then the offset is computed in years (defined as 365 24-hour days,
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich ignoring leap years), months (defined as 30 24-hour days), weeks,
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich days, hours, or minutes, respectively. Without a suffix, the offset
ecb0e3c0ca1489bc78b763cdfb6163c8c1043e2eAllen Rabinovich is computed in seconds. To explicitly prevent a date from being
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich set, use 'none' or 'never'.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <variablelist>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <term>-P <replaceable class="parameter">date/offset</replaceable></term>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Sets the date on which a key is to be published to the zone.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich After that date, the key will be included in the zone but will
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich not be used to sign it.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <term>-D <replaceable class="parameter">date/offset</replaceable></term>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich Sets the date on which the key is to be deleted. After that
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich date, the key will no longer be included in the zone. (It
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich may remain in the key repository, however.)
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </varlistentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </variablelist>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refsection>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refsection><info><title>FILES</title></info>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich A keyfile can be designed by the key identification
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <filename>Knnnn.+aaa+iiiii</filename> or the full file name
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <filename>Knnnn.+aaa+iiiii.key</filename> as generated by
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refsection>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refsection><info><title>SEE ALSO</title></info>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </citerefentry>,
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <citerefentry>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </citerefentry>,
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
176bb1f5c1bead550f24ffc878201352795c73adAllen Rabinovich </refsection>