dnssec-keyfromlabel.html revision 5347c0fcb04eaea19d9f39795646239f487c6207
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz - Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz - This Source Code Form is subject to the terms of the Mozilla Public
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz - License, v. 2.0. If a copy of the MPL was not distributed with this
ec8a35dd88f3e63f507b2bf2d7081eacd056fccbChris Morgan - file, You can obtain one at http://mozilla.org/MPL/2.0/.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free<p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free generates a key pair of files that referencing a key object stored
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free in a cryptographic hardware service module (HSM). The private key
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz file can be used for DNSSEC signing of zone data as if it were a
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz conventional signing key created by <span class="command"><strong>dnssec-keygen</strong></span>,
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz but the key material is stored within the HSM, and the actual signing
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz takes place there.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz The <code class="option">name</code> of the key is specified on the command
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free line. This must match the name of the zone for which the key is
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz being generated.
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould<div class="variablelist"><dl class="variablelist">
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free Selects the cryptographic algorithm. The value of
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free ECDSAP256SHA256 or ECDSAP384SHA384.
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free These values are case insensitive.
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free If no algorithm is specified, then RSASHA1 will be used by
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free default, unless the <code class="option">-3</code> option is specified,
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free in which case NSEC3RSASHA1 will be used instead. (If
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free <code class="option">-3</code> is used and an algorithm is specified,
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free that algorithm will be checked for compatibility with NSEC3.)
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free algorithm, and DSA is recommended.
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free Note 2: DH automatically sets the -k flag.
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free Use an NSEC3-capable algorithm to generate a DNSSEC key.
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free If this option is used and no algorithm is explicitly
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free set on the command line, NSEC3RSASHA1 will be used by
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free Specifies the cryptographic hardware to use.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz When BIND is built with OpenSSL PKCS#11 support, this defaults
529be660d9bfff799132ed1674b87dcff5d7a77dChris Morgan to the string "pkcs11", which identifies an OpenSSL engine
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz that can drive a cryptographic accelerator or hardware service
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free module. When BIND is built with native PKCS#11 cryptography
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free (--enable-native-pkcs11), it defaults to the path of the PKCS#11
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free provider library specified via "--with-pkcs11".
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Specifies the label for a key pair in the crypto hardware.
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz PKCS#11 support, the label is an arbitrary string that
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz identifies a particular key. It may be preceded by an
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould optional OpenSSL engine name, followed by a colon, as in
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould support, the label is a PKCS#11 URI string in the format
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould Keywords include "token", which identifies the HSM; "object", which
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz identifies the key; and "pin-source", which identifies a file from
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould which the HSM's PIN code can be obtained. The label will be
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz stored in the on-disk "private" file.
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould If the label contains a
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz <code class="option">pin-source</code> field, tools using the generated
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould key files will be able to use the HSM for signing and other
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free operations without any need for an operator to manually enter
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free a PIN. Note: Making the HSM's PIN accessible in this manner
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz may reduce the security advantage of using an HSM; be sure
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz this is what you want to do before making use of this feature.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould Specifies the owner type of the key. The value of
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz <code class="option">nametype</code> must either be ZONE (for a DNSSEC
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz a host (KEY)),
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz These values are case insensitive.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Compatibility mode: generates an old-style key, without
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz any metadata. By default, <span class="command"><strong>dnssec-keyfromlabel</strong></span>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz will include the key's creation date in the metadata stored
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz with the private key, and other dates may be set there as well
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould (publication date, activation date, etc). Keys that include
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz this data may be incompatible with older versions of BIND; the
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould <code class="option">-C</code> option suppresses them.
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Indicates that the DNS record containing the key should have
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould the specified class. If not specified, class IN is used.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
03919b7845e461f72fa5d954b8124d27481c46b0JazzyNico Set the specified flag in the flag field of the KEY/DNSKEY record.
03919b7845e461f72fa5d954b8124d27481c46b0JazzyNico The only recognized flags are KSK (Key Signing Key) and REVOKE.
2660fd94d4049b56d5d1f1d4ad4a0f6fd4065064~suv Generate a key, but do not publish it or sign with it. This
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz option is incompatible with -P and -A.
6bd244342631a687c2e2c2f4555e95bf1095fb9etavmjong-free Prints a short summary of the options and arguments to
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz <span class="command"><strong>dnssec-keyfromlabel</strong></span>.
86b3a7fc48d3fa59eb2e3289e0b8b2b56c7ed270Ted Gould<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Sets the directory in which the key files are to be written.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Generate KEY records rather than DNSKEY records.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Sets the default TTL to use for this key when it is converted
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz into a DNSKEY RR. If the key is imported into a zone,
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz this is the TTL that will be used for it, unless there was
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz already a DNSKEY RRset in place, in which case the existing TTL
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz would take precedence. Setting the default TTL to
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz <code class="literal">0</code> or <code class="literal">none</code> removes it.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Sets the protocol value for the key. The protocol
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz is a number between 0 and 255. The default is 3 (DNSSEC).
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Other possible values for this argument are listed in
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz RFC 2535 and its successors.
cf53497e8c338b4ea64e6abe7186909a4ee8ba98bryce<dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Generate a key as an explicit successor to an existing key.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz The name, algorithm, size, and type of the key will be set
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz to match the predecessor. The activation date of the new
cf53497e8c338b4ea64e6abe7186909a4ee8ba98bryce key will be set to the inactivation date of the existing
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz one. The publication date will be set to the activation
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz date minus the prepublication interval, which defaults to
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Indicates the use of the key. <code class="option">type</code> must be
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz is AUTHCONF. AUTH refers to the ability to authenticate
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz data, and CONF the ability to encrypt data.
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
e9330f65f5c10f3bfd7cba8b7639bbe3dd0e40d6Jon A. Cruz Sets the debugging level.
ef54197a64f49d1fea7d1cd79186ee17d259d5c2Krzysztof Kosiński Prints version information.
ef54197a64f49d1fea7d1cd79186ee17d259d5c2Krzysztof Kosiński Allows DNSSEC key files to be generated even if the key ID
ef54197a64f49d1fea7d1cd79186ee17d259d5c2Krzysztof Kosiński would collide with that of an existing key, in the event of
ef54197a64f49d1fea7d1cd79186ee17d259d5c2Krzysztof Kosiński either key being revoked. (This is only safe to use if you
ef54197a64f49d1fea7d1cd79186ee17d259d5c2Krzysztof Kosiński are sure you won't be using RFC 5011 trust anchor maintenance
c1a63ede06c89b7a4875a3fa9cdc5f2f914f9baaKrzysztof Kosiński with either of the keys involved.)
e154b9a23a70fe1776f7922a34fb78360482d431Martin Owens Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.