dnssec-keygen.html revision 2eeb74d1cf5355dd98f6d507a10086e16bb08c4b
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - Copyright (C) 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein - Copyright (C) 2000-2003 Internet Software Consortium.
fec3621e807f9367a76771ae74ea0ce4133764c4Mark Andrews - Permission to use, copy, modify, and/or distribute this software for any
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews - purpose with or without fee is hereby granted, provided that the above
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington - copyright notice and this permission notice appear in all copies.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.76.1">
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" title="dnssec-keygen">
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<a name="man.dnssec-keygen"></a><div class="titlepage"></div>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington <span class="application">dnssec-keygen</span>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington — DNSSEC key generation tool
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
6e8a8077faf96d8da0b6cf738913f5f1f86e4008Mark Andrews [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington <div class="refsection" title="DESCRIPTION">
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<a name="idp61001552"></a><h2>DESCRIPTION</h2>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington <p><span class="command"><strong>dnssec-keygen</strong></span>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington and RFC 4034. It can also generate keys for use with
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein (Transaction Key) as defined in RFC 2930.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The <code class="option">name</code> of the key is specified on the command
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein line. For DNSSEC keys, this must match the name of the zone for
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein which the key is being generated.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Selects the cryptographic algorithm. For DNSSEC keys, the value
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein ECDSAP256SHA256 or ECDSAP384SHA384.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington case insensitive.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein If no algorithm is specified, then RSASHA1 will be used by
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein default, unless the <code class="option">-3</code> option is specified,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein in which case NSEC3RSASHA1 will be used instead. (If
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington <code class="option">-3</code> is used and an algorithm is specified,
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington that algorithm will be checked for compatibility with NSEC3.)
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
b0c15bd9792112fb47f6d956e580e4369e92f4e7Mark Andrews automatically set the -T KEY option.
50105afc551903541608b11851d73278b23579a3Mark Andrews<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the number of bits in the key. The choice of key
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein size depends on the algorithm used. RSA keys must be
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein between 512 and 2048 bits. Diffie Hellman keys must be between
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein 128 and 4096 bits. DSA keys must be between 512 and 1024
50105afc551903541608b11851d73278b23579a3Mark Andrews bits and an exact multiple of 64. HMAC keys must be
50105afc551903541608b11851d73278b23579a3Mark Andrews between 1 and 512 bits. Elliptic curve algorithms don't need
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington this parameter.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein The key size does not need to be specified if using a default
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein algorithm. The default key size is 1024 bits for zone signing
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein keys (ZSKs) and 2048 bits for key signing keys (KSKs,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein generated with <code class="option">-f KSK</code>). However, if an
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein algorithm is explicitly specified with the <code class="option">-a</code>,
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington then there is no default key size, and the <code class="option">-b</code>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington must be used.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the owner type of the key. The value of
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <code class="option">nametype</code> must either be ZONE (for a DNSSEC
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
bf7f253e306d0ced8ae24d7a0598773950da11f4Mark Andrews a host (KEY)),
bf7f253e306d0ced8ae24d7a0598773950da11f4Mark Andrews USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington These values are case insensitive. Defaults to ZONE for DNSKEY
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Use an NSEC3-capable algorithm to generate a DNSSEC key.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein If this option is used and no algorithm is explicitly
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein set on the command line, NSEC3RSASHA1 will be used by
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein default. Note that RSASHA256, RSASHA512, ECCGOST,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein are NSEC3-capable.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Compatibility mode: generates an old-style key, without
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein any metadata. By default, <span class="command"><strong>dnssec-keygen</strong></span>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein will include the key's creation date in the metadata stored
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein with the private key, and other dates may be set there as well
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein (publication date, activation date, etc). Keys that include
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein this data may be incompatible with older versions of BIND; the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <code class="option">-C</code> option suppresses them.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Indicates that the DNS record containing the key should have
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington the specified class. If not specified, class IN is used.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the cryptographic hardware to use, when applicable.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein When BIND is built with OpenSSL PKCS#11 support, this defaults
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to the string "pkcs11", which identifies an OpenSSL engine
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington that can drive a cryptographic accelerator or hardware service
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington module. When BIND is built with native PKCS#11 cryptography
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington (--enable-native-pkcs11), it defaults to the path of the PKCS#11
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein provider library specified via "--with-pkcs11".
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Set the specified flag in the flag field of the KEY/DNSKEY record.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington The only recognized flags are KSK (Key Signing Key) and REVOKE.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Generate a key, but do not publish it or sign with it. This
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein option is incompatible with -P and -A.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein If generating a Diffie Hellman key, use this generator.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Allowed values are 2 and 5. If no generator
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is specified, a known prime from RFC 2539 will be used
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein if possible; otherwise the default is 2.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Prints a short summary of the options and arguments to
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <span class="command"><strong>dnssec-keygen</strong></span>.
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews Sets the directory in which the key files are to be written.
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews Deprecated in favor of -T KEY.
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews Sets the default TTL to use for this key when it is converted
6e8a8077faf96d8da0b6cf738913f5f1f86e4008Mark Andrews into a DNSKEY RR. If the key is imported into a zone,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein this is the TTL that will be used for it, unless there was
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein already a DNSKEY RRset in place, in which case the existing TTL
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein would take precedence. If this value is not set and there
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is no existing DNSKEY RRset, the TTL will default to the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein SOA TTL. Setting the default TTL to <code class="literal">0</code>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein or <code class="literal">none</code> is the same as leaving it unset.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the protocol value for the generated key. The protocol
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is a number between 0 and 255. The default is 3 (DNSSEC).
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Other possible values for this argument are listed in
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein RFC 2535 and its successors.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Quiet mode: Suppresses unnecessary output, including
6e8a8077faf96d8da0b6cf738913f5f1f86e4008Mark Andrews progress indication. Without this option, when
6e8a8077faf96d8da0b6cf738913f5f1f86e4008Mark Andrews <span class="command"><strong>dnssec-keygen</strong></span> is run interactively
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to generate an RSA or DSA key pair, it will print a string
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington of symbols to <code class="filename">stderr</code> indicating the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein progress of the key generation. A '.' indicates that a
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein random number has been found which passed an initial
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein sieve test; '+' means a number has passed a single
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein round of the Miller-Rabin primality test; a space
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein means that the number has passed all the tests and is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein a satisfactory key.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the source of randomness. If the operating
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein system does not provide a <code class="filename">/dev/random</code>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein or equivalent device, the default source of randomness
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is keyboard input. <code class="filename">randomdev</code>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington the name of a character device or file containing random
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington data to be used instead of the default. The special value
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews <code class="filename">keyboard</code> indicates that keyboard
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews input should be used.
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews<dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews Create a new key which is an explicit successor to an
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews existing key. The name, algorithm, size, and type of the
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews key will be set to match the existing key. The activation
e174044290953a2499f574e35cc9c22ba126a303Mark Andrews date of the new key will be set to the inactivation date of
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington the existing one. The publication date will be set to the
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington activation date minus the prepublication interval, which
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein defaults to 30 days.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the strength value of the key. The strength is
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein a number between 0 and 15, and currently has no defined
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington purpose in DNSSEC.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-T <em class="replaceable"><code>rrtype</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Specifies the resource record type to use for the key.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein <code class="option">rrtype</code> must be either DNSKEY or KEY. The
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein default is DNSKEY when using a DNSSEC algorithm, but it can be
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein overridden to KEY for use with SIG(0).
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Using any TSIG algorithm (HMAC-* or DH) forces this option
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Indicates the use of the key. <code class="option">type</code> must be
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is AUTHCONF. AUTH refers to the ability to authenticate
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein data, and CONF the ability to encrypt data.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the debugging level.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Prints version information.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<a name="idp61119056"></a><h2>TIMING OPTIONS</h2>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein If the argument begins with a '+' or '-', it is interpreted as
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein an offset from the present time. For convenience, if such an offset
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein then the offset is computed in years (defined as 365 24-hour days,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein ignoring leap years), months (defined as 30 24-hour days), weeks,
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington days, hours, or minutes, respectively. Without a suffix, the offset
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington is computed in seconds. To explicitly prevent a date from being
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington set, use 'none' or 'never'.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the date on which a key is to be published to the zone.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein After that date, the key will be included in the zone but will
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington not be used to sign it. If not set, and if the -G option has
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington not been used, the default is "now".
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Sets the date on which the key is to be activated. After that
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein date, the key will be included in the zone and used to sign
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein it. If not set, and if the -G option has not been used, the
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein default is "now". If set, if and -P is not set, then
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein the publication date will be set to the activation date
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein minus the prepublication interval.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the date on which the key is to be revoked. After that
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington date, the key will be flagged as revoked. It will be included
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington in the zone and will be used to sign it.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the date on which the key is to be retired. After that
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein date, the key will still be included in the zone, but it
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein will not be used to sign it.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein Sets the date on which the key is to be deleted. After that
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein date, the key will no longer be included in the zone. (It
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington may remain in the key repository, however.)
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington Sets the prepublication interval for a key. If set, then
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington the publication and activation dates must be separated by at least
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein this much time. If the activation date is specified but the
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington publication date isn't, then the publication date will default
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington to this much time before the activation date; conversely, if
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington the publication date is specified but activation date isn't,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein then activation will be set to this much time after publication.
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington If the key is being created as an explicit successor to another
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington key, then the default prepublication interval is 30 days;