dnssec-keyfromlabel.docbook revision eec29cfd40361662b25bad50e1b94f7738a8fea0
5cd4555ad444fd391002ae32450572054369fd42Rob Austein<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
5cd4555ad444fd391002ae32450572054369fd42Rob Austein "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt [<!ENTITY mdash "—">]>
81f58902eb5a1c1ab22742c72bd6cf318acbc06aTinderbox User - Copyright (C) 2008, 2009 Internet Systems Consortium, Inc. ("ISC")
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington - Permission to use, copy, modify, and/or distribute this software for any
ec5347e2c775f027573ce5648b910361aa926c01Automatic Updater - purpose with or without fee is hereby granted, provided that the above
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington - copyright notice and this permission notice appear in all copies.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
f5d30e2864e048a42c4dc1134993ae7efdb5d6c3Mark Andrews<!-- $Id: dnssec-keyfromlabel.docbook,v 1.13 2009/10/16 15:37:01 jreed Exp $ -->
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <refentryinfo>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley </refentryinfo>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <refentrytitle><application>dnssec-keyfromlabel</application></refentrytitle>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <refnamediv>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <refname><application>dnssec-keyfromlabel</application></refname>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <refpurpose>DNSSEC key generation tool</refpurpose>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley </refnamediv>
c1a883f2e04d94e99c433b1f6cfd0c0338f4ed85Mark Andrews <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <refsynopsisdiv>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <cmdsynopsis>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg choice="req">-l <replaceable class="parameter">label</replaceable></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
431859b442e89281a0d42652200a8de0668bc6b9Evan Hunt <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
b435b1ded3def3159f597953d21dffc1615cb250Brian Wellington <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
9b6a170d22d61026d31bde87523f3320628b6ebcBrian Wellington <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley </cmdsynopsis>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley </refsynopsisdiv>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein gets keys with the given label from a crypto hardware and builds
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein key files for DNSSEC (Secure DNS), as defined in RFC 2535
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein and RFC 4034.
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley The <option>name</option> of the key is specified on the command
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein line. This must match the name of the zone for which the key is
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt being generated.
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt <variablelist>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-a <replaceable class="parameter">algorithm</replaceable></term>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley Selects the cryptographic algorithm. The value of
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <option>algorithm</option> must be one of RSAMD5 (RSA),
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA or DH (Diffie Hellman).
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein These values are case insensitive.
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley If no algorithm is specified, then RSASHA1 will be used by
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley default, unless the <option>-3</option> option is specified,
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley in which case NSEC3RSASHA1 will be used instead.
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
c4f9e613e12f03795bee18cf2ca8e6a9d39d6468Mark Andrews algorithm, and DSA is recommended.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Note 2: DH automatically sets the -k flag.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley Use an NSEC3-capable algorithm to generate a DNSSEC key.
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley If this option is used and no algorithm is explicitly
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein set on the command line, NSEC3RSASHA1 will be used by
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <term>-E <replaceable class="parameter">engine</replaceable></term>
a769eca4e3b223866b01dc8f7a4dde8d9e49bab0Mark Andrews Specifies the name of the crypto hardware (OpenSSL engine).
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein When compiled with PKCS#11 support it defaults to "pcks11".
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <term>-l <replaceable class="parameter">label</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the label of the key pair in the crypto hardware.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The label may be preceded by an optional OpenSSL engine name,
a769eca4e3b223866b01dc8f7a4dde8d9e49bab0Mark Andrews separated by a colon, as in "pkcs11:keylabel".
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
6043e41fcf5dc91aa8a981c966512d73bdec31c1Mark Andrews <term>-n <replaceable class="parameter">nametype</replaceable></term>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the owner type of the key. The value of
6043e41fcf5dc91aa8a981c966512d73bdec31c1Mark Andrews <option>nametype</option> must either be ZONE (for a DNSSEC
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein a host (KEY)),
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley These values are case insensitive.
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Compatibility mode: generates an old-style key, without
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein any metadata. By default, <command>dnssec-keyfromlabel</command>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein will include the key's creation date in the metadata stored
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley with the private key, and other dates may be set there as well
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley (publication date, activation date, etc). Keys that include
e7c0d42b11358f08e04316d31c67c23261dcdf36Evan Hunt this data may be incompatible with older versions of BIND; the
e7c0d42b11358f08e04316d31c67c23261dcdf36Evan Hunt </varlistentry>
e7c0d42b11358f08e04316d31c67c23261dcdf36Evan Hunt <varlistentry>
e7c0d42b11358f08e04316d31c67c23261dcdf36Evan Hunt <term>-c <replaceable class="parameter">class</replaceable></term>
b435b1ded3def3159f597953d21dffc1615cb250Brian Wellington Indicates that the DNS record containing the key should have
b435b1ded3def3159f597953d21dffc1615cb250Brian Wellington the specified class. If not specified, class IN is used.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
b435b1ded3def3159f597953d21dffc1615cb250Brian Wellington <term>-f <replaceable class="parameter">flag</replaceable></term>
122c58bd11790c7576cdb1c6fd8e4439d0d7f7a5Mark Andrews Set the specified flag in the flag field of the KEY/DNSKEY record.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The only recognized flags are KSK (Key Signing Key) and REVOKE.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Generate a key, but do not publish it or sign with it. This
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein option is incompatible with -P and -A.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein </varlistentry>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <varlistentry>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley Prints a short summary of the options and arguments to
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley <term>-K <replaceable class="parameter">directory</replaceable></term>
4610465ed9408cbe434dbfb8be8ea53f48969c91Bob Halley Sets the directory in which the key files are to be written.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Generate KEY records rather than DNSKEY records.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <term>-p <replaceable class="parameter">protocol</replaceable></term>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Sets the protocol value for the key. The protocol
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt is a number between 0 and 255. The default is 3 (DNSSEC).
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Other possible values for this argument are listed in
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt RFC 2535 and its successors.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <term>-t <replaceable class="parameter">type</replaceable></term>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Indicates the use of the key. <option>type</option> must be
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt is AUTHCONF. AUTH refers to the ability to authenticate
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt data, and CONF the ability to encrypt data.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
8009525601d946805fae58b037cf7dad0da516f8Curtis Blackburn <varlistentry>
8009525601d946805fae58b037cf7dad0da516f8Curtis Blackburn <term>-v <replaceable class="parameter">level</replaceable></term>
8009525601d946805fae58b037cf7dad0da516f8Curtis Blackburn Sets the debugging level.
8009525601d946805fae58b037cf7dad0da516f8Curtis Blackburn </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </variablelist>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt If the argument begins with a '+' or '-', it is interpreted as
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt an offset from the present time. For convenience, if such an offset
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt then the offset is computed in years (defined as 365 24-hour days,
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt ignoring leap years), months (defined as 30 24-hour days), weeks,
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt days, hours, or minutes, respectively. Without a suffix, the offset
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt is computed in seconds.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <variablelist>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <term>-P <replaceable class="parameter">date/offset</replaceable></term>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Sets the date on which a key is to be published to the zone.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt After that date, the key will be included in the zone but will
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt not be used to sign it. If not set, and if the -G option has
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt not been used, the default is "now".
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <term>-A <replaceable class="parameter">date/offset</replaceable></term>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Sets the date on which the key is to be activated. After that
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt date, the key will be included in the zone and used to sign
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt it. If not set, and if the -G option has not been used, the
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt default is "now".
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <term>-R <replaceable class="parameter">date/offset</replaceable></term>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Sets the date on which the key is to be revoked. After that
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt date, the key will be flagged as revoked. It will be included
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt in the zone and will be used to sign it.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <term>-U <replaceable class="parameter">date/offset</replaceable></term>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Sets the date on which the key is to be retired. After that
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt date, the key will still be included in the zone, but it
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt will not be used to sign it.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <term>-D <replaceable class="parameter">date/offset</replaceable></term>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt Sets the date on which the key is to be deleted. After that
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt date, the key will no longer be included in the zone. (It
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt may remain in the key repository, however.)
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </varlistentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </variablelist>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt When <command>dnssec-keyfromlabel</command> completes
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt successfully,
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt to the standard output. This is an identification string for
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt the key files it has generated.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <itemizedlist>
62ec9fd1681ffae7d6b0d54618599ecf650e3100Mark Andrews <para><filename>nnnn</filename> is the key name.
62ec9fd1681ffae7d6b0d54618599ecf650e3100Mark Andrews <para><filename>aaa</filename> is the numeric representation
62ec9fd1681ffae7d6b0d54618599ecf650e3100Mark Andrews of the algorithm.
62ec9fd1681ffae7d6b0d54618599ecf650e3100Mark Andrews <para><filename>iiiii</filename> is the key identifier (or
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </itemizedlist>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt creates two files, with names based
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt on the printed string. <filename>Knnnn.+aaa+iiiii.key</filename>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt contains the public key, and
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <filename>Knnnn.+aaa+iiiii.private</filename> contains the
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt private key.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt The <filename>.key</filename> file contains a DNS KEY record
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt can be inserted into a zone file (directly or with a $INCLUDE
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt algorithm-specific
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt fields. For obvious security reasons, this file does not have
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt general read permission.
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </citerefentry>,
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <citerefentry>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt </citerefentry>,
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt <para><corpauthor>Internet Systems Consortium</corpauthor>
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt - Local variables:
1b2a4ce2b112ec91b0f13c411144e721c7952914Evan Hunt - mode: sgml