dnssec-importkey.html revision 2eeb74d1cf5355dd98f6d507a10086e16bb08c4b
a7051299c60cbaac13d62d35038460507459e140Tinderbox User - Copyright (C) 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - Permission to use, copy, modify, and/or distribute this software for any
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - purpose with or without fee is hereby granted, provided that the above
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - copyright notice and this permission notice appear in all copies.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
d2bdd5b314d3ee2250c740fe5fff8b91ab3731b2Tinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User<meta name="generator" content="DocBook XSL Stylesheets V1.76.1">
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" title="dnssec-importkey">
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<a name="man.dnssec-importkey"></a><div class="titlepage"></div>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <span class="application">dnssec-importkey</span>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User — Import DNSKEY records from external systems so they can be managed.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <div class="refsynopsisdiv" title="Synopsis">
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <code class="command">dnssec-importkey</code>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <code class="command">dnssec-importkey</code>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>}
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User<a name="idp60951888"></a><h2>DESCRIPTION</h2>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <p><span class="command"><strong>dnssec-importkey</strong></span>
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User reads a public DNSKEY record and generates a pair of
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User .key/.private files. The DNSKEY record may be read from an
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User existing .key file, in which case a corresponding .private file
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User will be generated, or it may be read from any other file or
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User from the standard input, in which case both .key and .private
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User files will be generated.
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User The newly-created .private file does <span class="emphasis"><em>not</em></span>
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User contain private key data, and cannot be used for signing.
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User However, having a .private file makes it possible to set
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User publication (<code class="option">-P</code>) and deletion
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User (<code class="option">-D</code>) times for the key, which means the
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User public key can be added to and removed from the DNSKEY RRset
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User on schedule even if the true private key is stored offline.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User Zone file mode: instead of a public keyfile name, the argument
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User is the DNS domain name of a zone master file, which can be read
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User from <code class="option">file</code>. If the domain name is the same as
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User <code class="option">file</code>, then it may be omitted.
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User the zone data is read from the standard input.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Sets the directory in which the key files are to reside.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Sets the default TTL to use for this key when it is converted
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews into a DNSKEY RR. If the key is imported into a zone,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews this is the TTL that will be used for it, unless there was
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews already a DNSKEY RRset in place, in which case the existing TTL
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User would take precedence. Setting the default TTL to
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <code class="literal">0</code> or <code class="literal">none</code> removes it.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Emit usage message and exit.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Sets the debugging level.
6f1205897504b8f50b1785975482c995888dd630Tinderbox User Prints version information.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <div class="refsection" title="TIMING OPTIONS">
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User<a name="idp60982480"></a><h2>TIMING OPTIONS</h2>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews If the argument begins with a '+' or '-', it is interpreted as
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews an offset from the present time. For convenience, if such an offset
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews then the offset is computed in years (defined as 365 24-hour days,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews ignoring leap years), months (defined as 30 24-hour days), weeks,
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews days, hours, or minutes, respectively. Without a suffix, the offset
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User is computed in seconds. To explicitly prevent a date from being
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User set, use 'none' or 'never'.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Sets the date on which a key is to be published to the zone.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews After that date, the key will be included in the zone but will
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews not be used to sign it.
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews Sets the date on which the key is to be deleted. After that
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews date, the key will no longer be included in the zone. (It
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews may remain in the key repository, however.)
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User A keyfile can be designed by the key identification
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
914ed533b846624c8ba5e7a72a5e8e50c9018b0aTinderbox User <span class="refentrytitle">dnssec-keygen</span>(8).
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <span class="refentrytitle">dnssec-keygen</span>(8)
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <span class="refentrytitle">dnssec-signzone</span>(8)
0c91911b4d1e872b87eaf6431ed47fe24d18dd43Mark Andrews <em class="citetitle">BIND 9 Administrator Reference Manual</em>,