dnssec-settime.docbook revision eab9975bcf5830a73f18ed8f320ae18ea32775ee
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt [<!ENTITY mdash "—">]>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - Permission to use, copy, modify, and/or distribute this software for any
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - purpose with or without fee is hereby granted, provided that the above
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - copyright notice and this permission notice appear in all copies.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - PERFORMANCE OF THIS SOFTWARE.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt<!-- $Id: dnssec-settime.docbook,v 1.3 2009/09/02 06:29:00 each Exp $ -->
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentryinfo>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </refentryinfo>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentrytitle><application>dnssec-settime</application></refentrytitle>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refnamediv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refname><application>dnssec-settime</application></refname>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refpurpose>Set the key timing metadata for a DNSSEC key</refpurpose>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </refnamediv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </copyright>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refsynopsisdiv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <cmdsynopsis>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-U <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </cmdsynopsis>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </refsynopsisdiv>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt reads a DNSSEC private key file and sets the key timing metadata
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt as specified by the <option>-P</option>, <option>-A</option>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <option>-R</option>, <option>-U</option>, and <option>-D</option>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt options. The metadata can then be used by
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <command>dnssec-signzone</command> or other signing software to
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt determine when a key is to be published, whether it should be
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt used for signing a zone, etc.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt If none of these options is set on the command line,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt then <command>dnssec-settime</command> simply prints the key timing
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt metadata already stored in the key.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt When key metadata fields are changed, both files of a key
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt pair (<filename>Knnnn.+aaa+iiiii.key</filename> and
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <filename>Knnnn.+aaa+iiiii.private</filename>) are regenerated.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Metadata fields are stored in the private file. A human-readable
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt description of the metadata is also placed in comments in the key
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Force an update of an old-format key with no metadata fields.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Without this option, <command>dnssec-settime</command> will
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt fail when attempting to update a legacy key. With this option,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt the key will be recreated in the new format, but with the
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt original key data retained. The key's creation date will be
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt set to the present time.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-K <replaceable class="parameter">directory</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the directory in which the key files are to reside.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Emit usage message and exit.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-v <replaceable class="parameter">level</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the debugging level.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt If the argument begins with a '+' or '-', it is interpreted as
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt an offset from the present time. For convenience, if such an offset
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt then the offset is computed in years (defined as 365 24-hour days,
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt ignoring leap years), months (defined as 30 24-hour days), weeks,
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt days, hours, or minutes, respectively. Without a suffix, the offset
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt is computed in seconds. To unset a date, use 'none'.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-P <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which a key is to be published to the zone.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt After that date, the key will be included in the zone but will
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt not be used to sign it.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-A <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which the key is to be activated. After that
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt date, the key will be included and the zone and used to sign
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-R <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which the key is to be revoked. After that
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt date, the key will be flagged as revoked. It will be included
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt in the zone and will be used to sign it.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-U <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which the key is to be unpublished. After that
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt date, the key will no longer be included in the zone, but it
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt may remain in the key repository.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <term>-D <replaceable class="parameter">date/offset</replaceable></term>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt Sets the date on which the key is to be deleted. After that
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt date, the key can be removed from the key repository.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt NOTE: Keys are not currently deleted automatically; this field
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt is included for informational purposes and for future
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt development.
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </varlistentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </variablelist>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <command>dnssec-settime</command> can also be used to print the
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt timing metadata associated with a key.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <variablelist>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <varlistentry>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt Print times in UNIX epoch format.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt </varlistentry>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <varlistentry>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt <term>-p <replaceable class="parameter">C/P/A/R/U/D/all</replaceable></term>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt Print a specific metadata value or set of metadata values.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt The <option>-p</option> option may be followed by one or more
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt of the following letters to indicate which value or values to print:
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt To print all of the metadata, use <option>-p all</option>.
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt </varlistentry>
eab9975bcf5830a73f18ed8f320ae18ea32775eeEvan Hunt </variablelist>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </citerefentry>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <citerefentry>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt </citerefentry>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt <para><corpauthor>Internet Systems Consortium</corpauthor>
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - Local variables:
553ead32ff5b00284e574dcabc39115d4d74ec66Evan Hunt - mode: sgml