dnssec-makekeyset.html revision 841179549b6433e782c164a562eb3422f603533d
97a9a944b5887e91042b019776c41d5dd74557aferikabele - Copyright (C) 2000, 2001 Internet Software Consortium.
a945f35eff8b6a88009ce73de6d4c862ce58de3cslive - Permission to use, copy, modify, and distribute this software for any
a945f35eff8b6a88009ce73de6d4c862ce58de3cslive - purpose with or without fee is hereby granted, provided that the above
a945f35eff8b6a88009ce73de6d4c862ce58de3cslive - copyright notice and this permission notice appear in all copies.
96ad5d81ee4a2cc66a4ae19893efc8aa6d06fae7jailletc - THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4nd - DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4nd - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen - INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
2e545ce2450a9953665f701bb05350f0d3f26275nd - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen - FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen - NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4nd - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen<!-- $Id: dnssec-makekeyset.html,v 1.3 2001/06/08 19:31:25 gson Exp $ -->
3f08db06526d6901aa08c110b5bc7dde6bc39905nd>dnssec-makekeyset</TITLE
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndNAME="GENERATOR"
3b3b7fc78d1f5bfc2769903375050048ff41ff26ndCONTENT="Modular DocBook HTML Stylesheet Version 1.61
1d980e5489836e977ba59b419e27b0ec875c4bd3takashiCLASS="REFENTRY"
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjungBGCOLOR="#FFFFFF"
3b3b7fc78d1f5bfc2769903375050048ff41ff26ndTEXT="#000000"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndLINK="#0000FF"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndVLINK="#840084"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndALINK="#0000FF"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndNAME="AEN1"
06ba4a61654b3763ad65f52283832ebf058fdf1csliveCLASS="APPLICATION"
06ba4a61654b3763ad65f52283832ebf058fdf1cslive>dnssec-makekeyset</SPAN
06ba4a61654b3763ad65f52283832ebf058fdf1csliveCLASS="REFNAMEDIV"
ccd7cf82b2654653ad0d29803184f64530b4f16bndNAME="AEN9"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndCLASS="APPLICATION"
c44eeebd065e2c8cd028016b45c58afb480aaf8fdruggeri>dnssec-makekeyset</SPAN
c44eeebd065e2c8cd028016b45c58afb480aaf8fdruggeri> -- DNSSEC zone signing tool</DIV
c44eeebd065e2c8cd028016b45c58afb480aaf8fdruggeriCLASS="REFSYNOPSISDIV"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndNAME="AEN13"
117c1f888a14e73cdd821dc6c23eb0411144a41cnd>Synopsis</H2
c44eeebd065e2c8cd028016b45c58afb480aaf8fdruggeriCLASS="COMMAND"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4nd>dnssec-makekeyset</B
30471a4650391f57975f60bbb6e4a90be7b284bfhumbedoohCLASS="OPTION"
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndCLASS="OPTION"
ccd7cf82b2654653ad0d29803184f64530b4f16bndCLASS="REPLACEABLE"
f804ec6e56dc58300c256b0fff0f2ca3f226c5b5nd>start-time</I
06ba4a61654b3763ad65f52283832ebf058fdf1csliveCLASS="OPTION"
ccd7cf82b2654653ad0d29803184f64530b4f16bndCLASS="REPLACEABLE"
ccd7cf82b2654653ad0d29803184f64530b4f16bnd>end-time</I
f4fa200e8481572da4d572759152b7c7c68facb4rbowenCLASS="OPTION"
69ff5ce0403acc1c95a727c5e8c66a65de16b3b3covenerCLASS="OPTION"
59877c2b4bb77f563370d7fb238f4a6d7a0e7f44minfrinCLASS="OPTION"
f4fa200e8481572da4d572759152b7c7c68facb4rbowenCLASS="REPLACEABLE"
46fb146a4ec8c97d8dccb8c0c96a6cfddfc5442cnd>randomdev</I
57b31f30545668d28e895efe7f5c0eb15d37a03figalicCLASS="OPTION"
57b31f30545668d28e895efe7f5c0eb15d37a03figalicCLASS="REPLACEABLE"
57b31f30545668d28e895efe7f5c0eb15d37a03figalicCLASS="OPTION"
57b31f30545668d28e895efe7f5c0eb15d37a03figalicCLASS="REPLACEABLE"
db8dceaf53a26fba6048c2ad4d86c5507344187drbowen>] {key...}</P
57b31f30545668d28e895efe7f5c0eb15d37a03figalicCLASS="REFSECT1"
89c751444e7e282537a4e9a529d0251eecf7915erpluemNAME="AEN38"
7159c12b7697fe9f5ab3a533cc6dfc3d57803053igalic>DESCRIPTION</H2
7159c12b7697fe9f5ab3a533cc6dfc3d57803053igalicCLASS="COMMAND"
89c751444e7e282537a4e9a529d0251eecf7915erpluem>dnssec-makekeyset</B
57b31f30545668d28e895efe7f5c0eb15d37a03figalic> generates a key set from one
e1e8390280254f7f0580d701e583f670643d4f3fnilgun or more keys created by <B
e1e8390280254f7f0580d701e583f670643d4f3fnilgunCLASS="COMMAND"
e1e8390280254f7f0580d701e583f670643d4f3fnilgun>dnssec-keygen</B
e1e8390280254f7f0580d701e583f670643d4f3fnilgun>. It creates
e1e8390280254f7f0580d701e583f670643d4f3fnilgun a file containing a KEY record for each key, and self-signs the key
57b31f30545668d28e895efe7f5c0eb15d37a03figalic set with each zone key. The output file is of the form
a0d937b340692a3578f1d2f2535890c520c4bf0cndCLASS="FILENAME"
a0d937b340692a3578f1d2f2535890c520c4bf0cnd>keyset-nnnn.</TT
57b31f30545668d28e895efe7f5c0eb15d37a03figalic>, where <TT
29b517f9fe7f32a2c3fbdc53e359b6db6f8e8c2csfCLASS="FILENAME"
57b31f30545668d28e895efe7f5c0eb15d37a03figalic is the zone name.
ccd7cf82b2654653ad0d29803184f64530b4f16bndCLASS="REFSECT1"
1ad1c5f9a82d056966dcca9c6108c5ace8eed446rbowenNAME="AEN45"
f4fa200e8481572da4d572759152b7c7c68facb4rbowen>OPTIONS</H2
22265f1724519886e2a2b5e0ebd61477506b7379noodlCLASS="VARIABLELIST"
5b111d121ddb14d690dde7c180402d0b9a030b7and> Verify all generated signatures.
ccd7cf82b2654653ad0d29803184f64530b4f16bndCLASS="REPLACEABLE"
57b31f30545668d28e895efe7f5c0eb15d37a03figalic>start-time</I
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen> Specify the date and time when the generated SIG records
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen become valid. This can be either an absolute or relative
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen time. An absolute start time is indicated by a number
57b31f30545668d28e895efe7f5c0eb15d37a03figalic in YYYYMMDDHHMMSS notation; 20000530144500 denotes
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsf 14:45:00 UTC on May 30th, 2000. A relative start time is
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen indicated by +N, which is N seconds from the current time.
ccd7cf82b2654653ad0d29803184f64530b4f16bndCLASS="OPTION"
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjung>start-time</TT
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjung> is specified, the current
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen time is used.
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjungCLASS="REPLACEABLE"
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjung>end-time</I
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjung> Specify the date and time when the generated SIG records
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjung expire. As with <TT
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjungCLASS="OPTION"
16c733f1d1ed4665c550ed8b9ff15abf7df85a48rjung>start-time</TT
57b31f30545668d28e895efe7f5c0eb15d37a03figalic>, an absolute
ccd7cf82b2654653ad0d29803184f64530b4f16bnd time is indicated in YYYYMMDDHHMMSS notation. A time relative
57b31f30545668d28e895efe7f5c0eb15d37a03figalic to the start time is indicated with +N, which is N seconds from
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen the start time. A time realtive to the current time is
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen indicated with now+N. If no <TT
57b31f30545668d28e895efe7f5c0eb15d37a03figalicCLASS="OPTION"
ccd7cf82b2654653ad0d29803184f64530b4f16bnd>end-time</TT
ccd7cf82b2654653ad0d29803184f64530b4f16bnd specified, 30 days from the start time is used as a default.
ccd7cf82b2654653ad0d29803184f64530b4f16bnd> Prints a short summary of the options and arguments to
ccd7cf82b2654653ad0d29803184f64530b4f16bndCLASS="COMMAND"
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen>dnssec-makekeyset</B
ccd7cf82b2654653ad0d29803184f64530b4f16bnd> Use pseudo-random data when signing the zone. This is faster,
0315519e77d53b8a90a9f4b36a6e38a11f931626rbowen but less secure, than using real random data. This option
57b31f30545668d28e895efe7f5c0eb15d37a03figalic may be useful when signing large zones or when the entropy
a2216d72fefddc2d3a51b9bcb92ad17b2a02f77frbowen source is limited.
25bc7d1859851f943172e286bf4ad5058f5ac11crbowenCLASS="REPLACEABLE"
9860a26381c920213ebbc3be9297dbf45cdfb3batrawick>randomdev</I
6c4ef4a72d9897e53365b94103f4bd819fd0d3acnd> Specifies the source of randomness. If the operating
6c4ef4a72d9897e53365b94103f4bd819fd0d3acnd system does not provide a <TT
6c4ef4a72d9897e53365b94103f4bd819fd0d3acndCLASS="FILENAME"
06ba4a61654b3763ad65f52283832ebf058fdf1cslive or equivalent device, the default source of randomness
6771d932c350b8af84039f3c71ebf9313dd52569kess is keyboard input. <TT
06ba4a61654b3763ad65f52283832ebf058fdf1csliveCLASS="FILENAME"
6771d932c350b8af84039f3c71ebf9313dd52569kess>randomdev</TT
6771d932c350b8af84039f3c71ebf9313dd52569kess> specifies
6771d932c350b8af84039f3c71ebf9313dd52569kess the name of a character device or file containing random
16055ce2030d5a9ab3b1797dfe4ba2c1177a6af9nd data to be used instead of the default. The special value
9a58dc6a2b26ec128b1270cf48810e705f1a90dbsfCLASS="FILENAME"
eb4f695144b447b4a8d31c4df7a50a65ffba12cbrbowen>keyboard</TT
eb4f695144b447b4a8d31c4df7a50a65ffba12cbrbowen> indicates that keyboard
eb4f695144b447b4a8d31c4df7a50a65ffba12cbrbowen input should be used.
eb4f695144b447b4a8d31c4df7a50a65ffba12cbrbowenCLASS="REPLACEABLE"
6771d932c350b8af84039f3c71ebf9313dd52569kess> Specify the TTL (time to live) of the KEY and SIG records.
6771d932c350b8af84039f3c71ebf9313dd52569kess The default is 3600 seconds.
6771d932c350b8af84039f3c71ebf9313dd52569kessCLASS="REPLACEABLE"
eb4f695144b447b4a8d31c4df7a50a65ffba12cbrbowen> Sets the debugging level.
6771d932c350b8af84039f3c71ebf9313dd52569kess> Lists the keys included in the keyset file. These keys
6771d932c350b8af84039f3c71ebf9313dd52569kess are expressed in the form <TT
6771d932c350b8af84039f3c71ebf9313dd52569kessCLASS="FILENAME"
6771d932c350b8af84039f3c71ebf9313dd52569kess>Knnnn.+aaa+iiiii</TT
6771d932c350b8af84039f3c71ebf9313dd52569kess as generated by <B
06ba4a61654b3763ad65f52283832ebf058fdf1csliveCLASS="COMMAND"
0237f43ab925775250e266e479d0a337ff374a4btakashi>dnssec-keygen</B
eb4f695144b447b4a8d31c4df7a50a65ffba12cbrbowenCLASS="REFSECT1"
e797af4d7b0cada1278d72d6c8ac77210ef78632minfrinNAME="AEN98"
eb4f695144b447b4a8d31c4df7a50a65ffba12cbrbowen>EXAMPLE</H2
6c4ef4a72d9897e53365b94103f4bd819fd0d3acnd> The following command generates a keyset containing the DSA key for
5d01f40ffd657dd2ac567aacd93cabd162ddfa79coarCLASS="USERINPUT"
6c4ef4a72d9897e53365b94103f4bd819fd0d3acnd> generated in the
6771d932c350b8af84039f3c71ebf9313dd52569kessCLASS="COMMAND"
06ba4a61654b3763ad65f52283832ebf058fdf1cslive>dnssec-keygen</B
6771d932c350b8af84039f3c71ebf9313dd52569kess> man page.
6771d932c350b8af84039f3c71ebf9313dd52569kessCLASS="USERINPUT"
6771d932c350b8af84039f3c71ebf9313dd52569kess>dnssec-makekeyset -t 86400 -s 20000701120000 -e +2592000 Kexample.com.+003+26160</B
6771d932c350b8af84039f3c71ebf9313dd52569kess> In this example, <B
6771d932c350b8af84039f3c71ebf9313dd52569kessCLASS="COMMAND"
6771d932c350b8af84039f3c71ebf9313dd52569kess>dnssec-makekeyset</B
6771d932c350b8af84039f3c71ebf9313dd52569kess the file <TT
6771d932c350b8af84039f3c71ebf9313dd52569kessCLASS="FILENAME"
6771d932c350b8af84039f3c71ebf9313dd52569kess>. This file
6771d932c350b8af84039f3c71ebf9313dd52569kess contains the specified key and a self-generated signature.
d1c9b754c81a2c21f812fd494d81f6cbe11d4fc7poirier> The DNS administrator for <TT
d1c9b754c81a2c21f812fd494d81f6cbe11d4fc7poirierCLASS="USERINPUT"
d1c9b754c81a2c21f812fd494d81f6cbe11d4fc7poirierCLASS="FILENAME"
6771d932c350b8af84039f3c71ebf9313dd52569kess> to the DNS
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4nd administrator for <TT
0c4abc32c00611fe1d52c9661f5cc79a3f74c6d4ndCLASS="USERINPUT"
06ba4a61654b3763ad65f52283832ebf058fdf1cslive> for signing, if the
06ba4a61654b3763ad65f52283832ebf058fdf1cslive .com zone is DNSSEC-aware and the administrators of the two zones
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar have some mechanism for authenticating each other and exchanging
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar the keys and signatures securely.
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="REFSECT1"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarNAME="AEN112"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar>SEE ALSO</H2
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="CITEREFENTRY"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="REFENTRYTITLE"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar>dnssec-keygen</SPAN
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="CITEREFENTRY"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="REFENTRYTITLE"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar>dnssec-signkey</SPAN
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="CITETITLE"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar>BIND 9 Administrator Reference Manual</I
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="CITETITLE"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar>RFC 2535</I
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarCLASS="REFSECT1"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coarNAME="AEN123"
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar>AUTHOR</H2
1f1b6bf13313fdd14a45e52e553d3ff28689b717coar> Internet Software Consortium