dnssec-settime.docbook revision c5259c013bba297cb0d38b85bd1c83fc26ef268c
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [<!ENTITY mdash "—">]>
f1c89cb4f5c72c54bb67dc48cd6f2b332eab9e92Automatic Updater - Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - Permission to use, copy, modify, and/or distribute this software for any
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - purpose with or without fee is hereby granted, provided that the above
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - copyright notice and this permission notice appear in all copies.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - PERFORMANCE OF THIS SOFTWARE.
c5259c013bba297cb0d38b85bd1c83fc26ef268cMark Andrews<!-- $Id: dnssec-settime.docbook,v 1.10 2010/03/09 03:35:34 marka Exp $ -->
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentryinfo>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </refentryinfo>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentrytitle><application>dnssec-settime</application></refentrytitle>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refnamediv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refname><application>dnssec-settime</application></refname>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refpurpose>Set the key timing metadata for a DNSSEC key</refpurpose>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </refnamediv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </copyright>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refsynopsisdiv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <cmdsynopsis>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </cmdsynopsis>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </refsynopsisdiv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt reads a DNSSEC private key file and sets the key timing metadata
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt as specified by the <option>-P</option>, <option>-A</option>,
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt <option>-R</option>, <option>-I</option>, and <option>-D</option>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt options. The metadata can then be used by
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <command>dnssec-signzone</command> or other signing software to
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt determine when a key is to be published, whether it should be
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt used for signing a zone, etc.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt If none of these options is set on the command line,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt then <command>dnssec-settime</command> simply prints the key timing
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt metadata already stored in the key.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt When key metadata fields are changed, both files of a key
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt pair (<filename>Knnnn.+aaa+iiiii.key</filename> and
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <filename>Knnnn.+aaa+iiiii.private</filename>) are regenerated.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Metadata fields are stored in the private file. A human-readable
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt description of the metadata is also placed in comments in the key
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Force an update of an old-format key with no metadata fields.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Without this option, <command>dnssec-settime</command> will
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt fail when attempting to update a legacy key. With this option,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt the key will be recreated in the new format, but with the
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt original key data retained. The key's creation date will be
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt set to the present time.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-K <replaceable class="parameter">directory</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the directory in which the key files are to reside.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Emit usage message and exit.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-v <replaceable class="parameter">level</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the debugging level.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont <varlistentry>
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont <term>-E <replaceable class="parameter">engine</replaceable></term>
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont Use the given OpenSSL engine. When compiled with PKCS#11 support
f80b665135127a12ca503c8830aa465aa1ddd17dEvan Hunt it defaults to pkcs11; the empty name resets it to no engine.
8b78c993cb475cc94e88560941b28c37684789d9Francis Dupont </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt If the argument begins with a '+' or '-', it is interpreted as
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt an offset from the present time. For convenience, if such an offset
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt then the offset is computed in years (defined as 365 24-hour days,
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt ignoring leap years), months (defined as 30 24-hour days), weeks,
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt days, hours, or minutes, respectively. Without a suffix, the offset
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt is computed in seconds. To unset a date, use 'none'.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-P <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which a key is to be published to the zone.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt After that date, the key will be included in the zone but will
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt not be used to sign it.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-A <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which the key is to be activated. After that
eec29cfd40361662b25bad50e1b94f7738a8fea0Jeremy Reed date, the key will be included in the zone and used to sign
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-R <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which the key is to be revoked. After that
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt date, the key will be flagged as revoked. It will be included
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt in the zone and will be used to sign it.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt <term>-I <replaceable class="parameter">date/offset</replaceable></term>
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt Sets the date on which the key is to be retired. After that
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt date, the key will still be included in the zone, but it
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt will not be used to sign it.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-D <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which the key is to be deleted. After that
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt date, the key will no longer be included in the zone. (It
b843f577bbcd6660fbaa506d9e55b156c689a5a8Evan Hunt may remain in the key repository, however.)
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </variablelist>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <command>dnssec-settime</command> can also be used to print the
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt timing metadata associated with a key.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <variablelist>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <varlistentry>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt Print times in UNIX epoch format.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt </varlistentry>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <varlistentry>
c5259c013bba297cb0d38b85bd1c83fc26ef268cMark Andrews <term>-p <replaceable class="parameter">C/P/A/R/I/D/all</replaceable></term>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt Print a specific metadata value or set of metadata values.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt The <option>-p</option> option may be followed by one or more
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt of the following letters to indicate which value or values to print:
c5259c013bba297cb0d38b85bd1c83fc26ef268cMark Andrews <option>I</option> for the inactivation date, or
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt To print all of the metadata, use <option>-p all</option>.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt </varlistentry>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt </variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </citerefentry>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <citerefentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </citerefentry>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <para><corpauthor>Internet Systems Consortium</corpauthor>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - Local variables:
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - mode: sgml