1N/A - Copyright (C) 2009-2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC") 1N/A - This Source Code Form is subject to the terms of the Mozilla Public 1N/A - License, v. 2.0. If a copy of the MPL was not distributed with this 1N/A<!-- Converted by db4-upgrade version 1.0 --> 1N/A <
date>2015-08-21</
date>
1N/A <
corpname>ISC</
corpname>
1N/A <
corpauthor>Internet Systems Consortium, Inc.</
corpauthor>
1N/A <
refentrytitle><
application>dnssec-settime</
application></
refentrytitle>
1N/A <
manvolnum>8</
manvolnum>
1N/A <
refmiscinfo>BIND9</
refmiscinfo>
1N/A <
refname><
application>dnssec-settime</
application></
refname>
1N/A <
refpurpose>set the key timing metadata for a DNSSEC key</
refpurpose>
1N/A <
holder>Internet Systems Consortium, Inc. ("ISC")</
holder>
1N/A <
cmdsynopsis sepchar=" ">
1N/A <
command>dnssec-settime</
command>
1N/A <
arg choice="opt" rep="norepeat"><
option>-f</
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-K <
replaceable class="parameter">directory</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-L <
replaceable class="parameter">ttl</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-P <
replaceable class="parameter">
date/
offset</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-P sync <
replaceable class="parameter">
date/
offset</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-A <
replaceable class="parameter">
date/
offset</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-R <
replaceable class="parameter">
date/
offset</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-I <
replaceable class="parameter">
date/
offset</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-D <
replaceable class="parameter">
date/
offset</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-D sync <
replaceable class="parameter">
date/
offset</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-S <
replaceable class="parameter">key</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-i <
replaceable class="parameter">interval</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-h</
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-V</
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-v <
replaceable class="parameter">level</
replaceable></
option></
arg>
1N/A <
arg choice="opt" rep="norepeat"><
option>-E <
replaceable class="parameter">engine</
replaceable></
option></
arg>
1N/A <
arg choice="req" rep="norepeat">keyfile</
arg>
1N/A <
refsection><
info><
title>DESCRIPTION</
title></
info>
1N/A <
para><
command>dnssec-settime</
command>
1N/A reads a DNSSEC private key file and sets the key timing metadata
1N/A as specified by the <
option>-P</
option>, <
option>-A</
option>,
1N/A <
option>-R</
option>, <
option>-I</
option>, and <
option>-D</
option>
1N/A options. The metadata can then be used by
1N/A <
command>dnssec-signzone</
command> or other signing software to
1N/A determine when a key is to be published, whether it should be
1N/A used for signing a zone, etc.
1N/A If none of these options is set on the command line,
1N/A then <
command>dnssec-settime</
command> simply prints the key timing
1N/A metadata already stored in the key.
1N/A When key metadata fields are changed, both files of a key
1N/A Metadata fields are stored in the private file. A human-readable
1N/A description of the metadata is also placed in comments in the key
1N/A file. The private file's permissions are always set to be
1N/A inaccessible to anyone other than the owner (mode 0600).
1N/A <
refsection><
info><
title>OPTIONS</
title></
info>
1N/A Force an update of an old-format key with no metadata fields.
1N/A Without this option, <
command>dnssec-settime</
command> will
1N/A fail when attempting to update a legacy key. With this option,
1N/A the key will be recreated in the new format, but with the
1N/A original key data retained. The key's creation date will be
1N/A set to the present time. If no other values are specified,
1N/A then the key's publication and activation dates will also
1N/A be set to the present time.
1N/A <
term>-K <
replaceable class="parameter">directory</
replaceable></
term>
1N/A Sets the directory in which the key files are to reside.
1N/A <
term>-L <
replaceable class="parameter">ttl</
replaceable></
term>
1N/A Sets the default TTL to use for this key when it is converted
1N/A into a DNSKEY RR. If the key is imported into a zone,
1N/A this is the TTL that will be used for it, unless there was
1N/A already a DNSKEY RRset in place, in which case the existing TTL
1N/A would take precedence. If this value is not set and there
1N/A is no existing DNSKEY RRset, the TTL will default to the
1N/A SOA TTL. Setting the default TTL to <
literal>0</
literal>
1N/A or <
literal>none</
literal> removes it from the key.
1N/A Emit usage message and exit.
1N/A Prints version information.
1N/A <
term>-v <
replaceable class="parameter">level</
replaceable></
term>
1N/A Sets the debugging level.
1N/A <
term>-E <
replaceable class="parameter">engine</
replaceable></
term>
1N/A Specifies the cryptographic hardware to use, when applicable.
1N/A When BIND is built with OpenSSL PKCS#11 support, this defaults
1N/A to the string "pkcs11", which identifies an OpenSSL engine
1N/A that can drive a cryptographic accelerator or hardware service
1N/A module. When BIND is built with native PKCS#11 cryptography
1N/A (--enable-native-pkcs11), it defaults to the path of the PKCS#11
1N/A provider library specified via "--with-pkcs11".
1N/A <
refsection><
info><
title>TIMING OPTIONS</
title></
info>
1N/A Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
1N/A If the argument begins with a '+' or '-', it is interpreted as
1N/A an offset from the present time. For convenience, if such an offset
1N/A is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
1N/A then the offset is computed in years (defined as 365 24-hour days,
1N/A ignoring leap years), months (defined as 30 24-hour days), weeks,
1N/A days, hours, or minutes, respectively. Without a suffix, the offset
1N/A is computed in seconds. To unset a date, use 'none' or 'never'.
1N/A <
term>-P <
replaceable class="parameter">
date/
offset</
replaceable></
term>
1N/A Sets the date on which a key is to be published to the zone.
1N/A After that date, the key will be included in the zone but will
1N/A not be used to sign it.
1N/A <
term>-P sync <
replaceable class="parameter">
date/
offset</
replaceable></
term>
1N/A Sets the date on which CDS and CDNSKEY records that match this
1N/A key are to be published to the zone.
1N/A <
term>-A <
replaceable class="parameter">
date/
offset</
replaceable></
term>
1N/A Sets the date on which the key is to be activated. After that
1N/A date, the key will be included in the zone and used to sign
1N/A <
term>-R <
replaceable class="parameter">
date/
offset</
replaceable></
term>
1N/A Sets the date on which the key is to be revoked. After that
1N/A date, the key will be flagged as revoked. It will be included
1N/A in the zone and will be used to sign it.
1N/A <
term>-I <
replaceable class="parameter">
date/
offset</
replaceable></
term>
1N/A Sets the date on which the key is to be retired. After that
1N/A date, the key will still be included in the zone, but it
1N/A will not be used to sign it.
1N/A <
term>-D <
replaceable class="parameter">
date/
offset</
replaceable></
term>
1N/A Sets the date on which the key is to be deleted. After that
1N/A date, the key will no longer be included in the zone. (It
1N/A may remain in the key repository, however.)
1N/A <
term>-D sync <
replaceable class="parameter">
date/
offset</
replaceable></
term>
1N/A Sets the date on which the CDS and CDNSKEY records that match this
1N/A key are to be deleted.
1N/A <
term>-S <
replaceable class="parameter">predecessor key</
replaceable></
term>
1N/A Select a key for which the key being modified will be an
1N/A explicit successor. The name, algorithm, size, and type of the
1N/A predecessor key must exactly match those of the key being
1N/A modified. The activation date of the successor key will be set
1N/A to the inactivation date of the predecessor. The publication
1N/A date will be set to the activation date minus the prepublication
1N/A interval, which defaults to 30 days.
1N/A <
term>-i <
replaceable class="parameter">interval</
replaceable></
term>
1N/A Sets the prepublication interval for a key. If set, then
1N/A the publication and activation dates must be separated by at least
1N/A this much time. If the activation date is specified but the
1N/A publication date isn't, then the publication date will default
1N/A to this much time before the activation date; conversely, if
1N/A the publication date is specified but activation date isn't,
1N/A then activation will be set to this much time after publication.
1N/A If the key is being set to be an explicit successor to another
1N/A key, then the default prepublication interval is 30 days;
1N/A otherwise it is zero.
1N/A As with date offsets, if the argument is followed by one of
1N/A the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
1N/A interval is measured in years, months, weeks, days, hours,
1N/A or minutes, respectively. Without a suffix, the interval is
1N/A measured in seconds.
<
refsection><
info><
title>PRINTING OPTIONS</
title></
info>
<
command>dnssec-settime</
command> can also be used to print the
timing metadata associated with a key.
Print times in UNIX epoch format.
Print a specific metadata value or set of metadata values.
The <
option>-p</
option> option may be followed by one or more
of the following letters or strings to indicate which value
<
option>C</
option> for the creation date,
<
option>P</
option> for the publication date,
<
option>Psync</
option> for the CDS and CDNSKEY publication date,
<
option>A</
option> for the activation date,
<
option>R</
option> for the revocation date,
<
option>I</
option> for the inactivation date,
<
option>D</
option> for the deletion date, and
<
option>Dsync</
option> for the CDS and CDNSKEY deletion date
To print all of the metadata, use <
option>-p all</
option>.
<
refsection><
info><
title>SEE ALSO</
title></
info>
<
refentrytitle>dnssec-keygen</
refentrytitle><
manvolnum>8</
manvolnum>
<
refentrytitle>dnssec-signzone</
refentrytitle><
manvolnum>8</
manvolnum>
<
citetitle>BIND 9 Administrator Reference Manual</
citetitle>,
<
citetitle>RFC 5011</
citetitle>.