dnssec-keygen.html revision ef8014e56f35bb36daa5fd2c313f5e7963e97aa1
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen - Copyright (C) 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen - Copyright (C) 2000-2003 Internet Software Consortium.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen - Permission to use, copy, modify, and/or distribute this software for any
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen - purpose with or without fee is hereby granted, provided that the above
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen - copyright notice and this permission notice appear in all copies.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
bad5981f287ff1e4094428e27178062548215a93Timo Sirainen - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen - PERFORMANCE OF THIS SOFTWARE.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen<a name="man.dnssec-keygen"></a><div class="titlepage"></div>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<p><span class="application">dnssec-keygen</span> — DNSSEC key generation tool</p>
01af88dfbb7a022ddb3ab9fb4159f2a4a204ead3Timo Sirainen<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<p><span><strong class="command">dnssec-keygen</strong></span>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen and RFC 4034. It can also generate keys for use with
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY
c0435c854a0e7246373b9752d163095cc4fbe985Timo Sirainen (Transaction Key) as defined in RFC 2930.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen The <code class="option">name</code> of the key is specified on the command
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen line. For DNSSEC keys, this must match the name of the zone for
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen which the key is being generated.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Selects the cryptographic algorithm. For DNSSEC keys, the value
2ca64e9cb20ca517a5a0d4ba3b73dccb2a0dd973Timo Sirainen of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
2ca64e9cb20ca517a5a0d4ba3b73dccb2a0dd973Timo Sirainen ECDSAP256SHA256 or ECDSAP384SHA384.
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen case insensitive.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen If no algorithm is specified, then RSASHA1 will be used by
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen default, unless the <code class="option">-3</code> option is specified,
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen in which case NSEC3RSASHA1 will be used instead. (If
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen <code class="option">-3</code> is used and an algorithm is specified,
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen that algorithm will be checked for compatibility with NSEC3.)
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
156a7c9057782ea8d805c4223082e1dd6041ef21Timo Sirainen automatically set the -T KEY option.
156a7c9057782ea8d805c4223082e1dd6041ef21Timo Sirainen<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Specifies the number of bits in the key. The choice of key
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen size depends on the algorithm used. RSA keys must be
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen between 512 and 2048 bits. Diffie Hellman keys must be between
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen 128 and 4096 bits. DSA keys must be between 512 and 1024
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen bits and an exact multiple of 64. HMAC keys must be
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen between 1 and 512 bits. Elliptic curve algorithms don't need
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen this parameter.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen The key size does not need to be specified if using a default
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen algorithm. The default key size is 1024 bits for zone signing
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen keys (ZSKs) and 2048 bits for key signing keys (KSKs,
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen generated with <code class="option">-f KSK</code>). However, if an
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen algorithm is explicitly specified with the <code class="option">-a</code>,
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen then there is no default key size, and the <code class="option">-b</code>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen must be used.
c0435c854a0e7246373b9752d163095cc4fbe985Timo Sirainen<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
c0435c854a0e7246373b9752d163095cc4fbe985Timo Sirainen Specifies the owner type of the key. The value of
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen <code class="option">nametype</code> must either be ZONE (for a DNSSEC
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen a host (KEY)),
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen These values are case insensitive. Defaults to ZONE for DNSKEY
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Use an NSEC3-capable algorithm to generate a DNSSEC key.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen If this option is used and no algorithm is explicitly
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen set on the command line, NSEC3RSASHA1 will be used by
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen default. Note that RSASHA256, RSASHA512, ECCGOST,
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen are NSEC3-capable.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Compatibility mode: generates an old-style key, without
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen any metadata. By default, <span><strong class="command">dnssec-keygen</strong></span>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen will include the key's creation date in the metadata stored
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen with the private key, and other dates may be set there as well
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen (publication date, activation date, etc). Keys that include
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen this data may be incompatible with older versions of BIND; the
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen <code class="option">-C</code> option suppresses them.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
c0435c854a0e7246373b9752d163095cc4fbe985Timo Sirainen Indicates that the DNS record containing the key should have
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen the specified class. If not specified, class IN is used.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Specifies the cryptographic hardware to use, when applicable.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen When BIND is built with OpenSSL PKCS#11 support, this defaults
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen to the string "pkcs11", which identifies an OpenSSL engine
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen that can drive a cryptographic accelerator or hardware service
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen module. When BIND is built with native PKCS#11 cryptography
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen (--enable-native-pkcs11), it defaults to the path of the PKCS#11
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen provider library specified via "--with-pkcs11".
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Set the specified flag in the flag field of the KEY/DNSKEY record.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen The only recognized flags are KSK (Key Signing Key) and REVOKE.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Generate a key, but do not publish it or sign with it. This
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen option is incompatible with -P and -A.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen If generating a Diffie Hellman key, use this generator.
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen Allowed values are 2 and 5. If no generator
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen is specified, a known prime from RFC 2539 will be used
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen if possible; otherwise the default is 2.
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen Prints a short summary of the options and arguments to
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen <span><strong class="command">dnssec-keygen</strong></span>.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Sets the directory in which the key files are to be written.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Deprecated in favor of -T KEY.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Sets the default TTL to use for this key when it is converted
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen into a DNSKEY RR. If the key is imported into a zone,
b406127781a4237845301c02e81fac8bf1c11612Timo Sirainen this is the TTL that will be used for it, unless there was
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen already a DNSKEY RRset in place, in which case the existing TTL
b406127781a4237845301c02e81fac8bf1c11612Timo Sirainen would take precedence. If this value is not set and there
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen is no existing DNSKEY RRset, the TTL will default to the
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen SOA TTL. Setting the default TTL to <code class="literal">0</code>
a29a5b7520f7b8d6cdaf97e66d184b6a9e4f4ecfTimo Sirainen or <code class="literal">none</code> is the same as leaving it unset.
2ca64e9cb20ca517a5a0d4ba3b73dccb2a0dd973Timo Sirainen<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
2ca64e9cb20ca517a5a0d4ba3b73dccb2a0dd973Timo Sirainen Sets the protocol value for the generated key. The protocol
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen is a number between 0 and 255. The default is 3 (DNSSEC).
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen Other possible values for this argument are listed in
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen RFC 2535 and its successors.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Quiet mode: Suppresses unnecessary output, including
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen progress indication. Without this option, when
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen <span><strong class="command">dnssec-keygen</strong></span> is run interactively
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen to generate an RSA or DSA key pair, it will print a string
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen of symbols to <code class="filename">stderr</code> indicating the
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen progress of the key generation. A '.' indicates that a
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen random number has been found which passed an initial
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen sieve test; '+' means a number has passed a single
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen round of the Miller-Rabin primality test; a space
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen means that the number has passed all the tests and is
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen a satisfactory key.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen Specifies the source of randomness. If the operating
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen system does not provide a <code class="filename">/dev/random</code>
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen or equivalent device, the default source of randomness
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen is keyboard input. <code class="filename">randomdev</code>
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen the name of a character device or file containing random
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen data to be used instead of the default. The special value
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen <code class="filename">keyboard</code> indicates that keyboard
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen input should be used.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen<dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Create a new key which is an explicit successor to an
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen existing key. The name, algorithm, size, and type of the
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen key will be set to match the existing key. The activation
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen date of the new key will be set to the inactivation date of
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen the existing one. The publication date will be set to the
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen activation date minus the prepublication interval, which
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen defaults to 30 days.
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen<dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Specifies the strength value of the key. The strength is
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen a number between 0 and 15, and currently has no defined
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen purpose in DNSSEC.
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen<dt><span class="term">-T <em class="replaceable"><code>rrtype</code></em></span></dt>
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen Specifies the resource record type to use for the key.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen <code class="option">rrtype</code> must be either DNSKEY or KEY. The
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen default is DNSKEY when using a DNSSEC algorithm, but it can be
5254d77805cd35b9356d072ba325c356c43b0d51Timo Sirainen overridden to KEY for use with SIG(0).
0138d3060877805f0de0bf631642de100ff96b79Timo Sirainen Using any TSIG algorithm (HMAC-* or DH) forces this option
0138d3060877805f0de0bf631642de100ff96b79Timo Sirainen<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
0138d3060877805f0de0bf631642de100ff96b79Timo Sirainen Indicates the use of the key. <code class="option">type</code> must be
0138d3060877805f0de0bf631642de100ff96b79Timo Sirainen one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
0138d3060877805f0de0bf631642de100ff96b79Timo Sirainen is AUTHCONF. AUTH refers to the ability to authenticate
0138d3060877805f0de0bf631642de100ff96b79Timo Sirainen data, and CONF the ability to encrypt data.
0138d3060877805f0de0bf631642de100ff96b79Timo Sirainen<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Sets the debugging level.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Prints version information.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen<a name="id2544292"></a><h2>TIMING OPTIONS</h2>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen If the argument begins with a '+' or '-', it is interpreted as
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen an offset from the present time. For convenience, if such an offset
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen then the offset is computed in years (defined as 365 24-hour days,
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen ignoring leap years), months (defined as 30 24-hour days), weeks,
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen days, hours, or minutes, respectively. Without a suffix, the offset
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen is computed in seconds. To explicitly prevent a date from being
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen set, use 'none' or 'never'.
c0435c854a0e7246373b9752d163095cc4fbe985Timo Sirainen<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Sets the date on which a key is to be published to the zone.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen After that date, the key will be included in the zone but will
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen not be used to sign it. If not set, and if the -G option has
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen not been used, the default is "now".
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Sets the date on which the key is to be activated. After that
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen date, the key will be included in the zone and used to sign
9edba36ef9b2679b0585c345074b1f1d482bfd20Timo Sirainen it. If not set, and if the -G option has not been used, the
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen default is "now". If set, if and -P is not set, then
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen the publication date will be set to the activation date
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen minus the prepublication interval.
38499bb33c74acc6d725204e893cfc02a5890ec7Timo Sirainen<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Sets the date on which the key is to be revoked. After that
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen date, the key will be flagged as revoked. It will be included
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen in the zone and will be used to sign it.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen Sets the date on which the key is to be retired. After that
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen date, the key will still be included in the zone, but it
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen will not be used to sign it.
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen Sets the date on which the key is to be deleted. After that
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen date, the key will no longer be included in the zone. (It
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen may remain in the key repository, however.)
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen Sets the prepublication interval for a key. If set, then
40f114f2e12605483b21e7cf048b7c9bd9568148Timo Sirainen the publication and activation dates must be separated by at least
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen this much time. If the activation date is specified but the
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen publication date isn't, then the publication date will default
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen to this much time before the activation date; conversely, if
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen the publication date is specified but activation date isn't,
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen then activation will be set to this much time after publication.
b561170c84d19ef1dee3d528939d77fd38047b3fTimo Sirainen If the key is being created as an explicit successor to another
def516ea503a60f20d510c14d5070b7ff5bbddf4Timo Sirainen key, then the default prepublication interval is 30 days;
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen otherwise it is zero.
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen As with date offsets, if the argument is followed by one of
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
c0435c854a0e7246373b9752d163095cc4fbe985Timo Sirainen interval is measured in years, months, weeks, days, hours,
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen or minutes, respectively. Without a suffix, the interval is
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen measured in seconds.
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen<a name="id2544413"></a><h2>GENERATED KEYS</h2>
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen When <span><strong class="command">dnssec-keygen</strong></span> completes
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen successfully,
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen to the standard output. This is an identification string for
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen the key it has generated.
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen<li><p><code class="filename">nnnn</code> is the key name.
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen<li><p><code class="filename">aaa</code> is the numeric representation
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen<li><p><code class="filename">iiiii</code> is the key identifier (or
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen<p><span><strong class="command">dnssec-keygen</strong></span>
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen creates two files, with names based
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen contains the public key, and
fc7b32b6a2a65d604c8070b9b1a204f25c90b391Timo Sirainen <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the