37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-settime">

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <info>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <date>2015-08-21</date>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync </info>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <refentryinfo>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <corpname>ISC</corpname>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <corpauthor>Internet Systems Consortium, Inc.</corpauthor>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync </refentryinfo>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <refmeta>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <refentrytitle><application>dnssec-settime</application></refentrytitle>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <manvolnum>8</manvolnum>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <refmiscinfo>BIND9</refmiscinfo>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync </refmeta>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <refnamediv>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <refname><application>dnssec-settime</application></refname>

058e9c6d97c5306126f83d934148c658804f1d6cvboxsync <refpurpose>set the key timing metadata for a DNSSEC key</refpurpose>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync </refnamediv>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <docinfo>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <copyright>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <year>2009</year>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <year>2010</year>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <year>2011</year>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <year>2014</year>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <year>2015</year>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <year>2016</year>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync </copyright>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync </docinfo>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <refsynopsisdiv>

aa4bcf0a4b2db3ac352b56a291d49cb8d4b66d32vboxsync <cmdsynopsis sepchar=" ">

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <command>dnssec-settime</command>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <arg choice="opt" rep="norepeat"><option>-f</option></arg>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>

e91f2a55ed5a30342ec79ce273f3f4bad8283336vboxsync <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>

40b7f0c2d3f97e0c6171f34f96ec3e05eea44d72vboxsync <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>

78df3a3ca20e014e0d9eb72cd7bb72711255d5f6vboxsync <arg choice="opt" rep="norepeat"><option>-h</option></arg>

e43535ace2499e7f8ef8822186047979bd58d464vboxsync <arg choice="opt" rep="norepeat"><option>-V</option></arg>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <arg choice="req" rep="norepeat">keyfile</arg>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync </cmdsynopsis>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync </refsynopsisdiv>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <refsection><info><title>DESCRIPTION</title></info>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync

a7aa94e0115a73841f34ebbfa00f63fa1904e51fvboxsync <para><command>dnssec-settime</command>

b6cc138b99f86c2d29ecfe32cecf9f68ba5e73afvboxsync reads a DNSSEC private key file and sets the key timing metadata

0e5731ab59b4ecead38375f26eeea698f00b19fdvboxsync as specified by the <option>-P</option>, <option>-A</option>,

0e5731ab59b4ecead38375f26eeea698f00b19fdvboxsync <option>-R</option>, <option>-I</option>, and <option>-D</option>

0e5731ab59b4ecead38375f26eeea698f00b19fdvboxsync options. The metadata can then be used by

a7aa94e0115a73841f34ebbfa00f63fa1904e51fvboxsync <command>dnssec-signzone</command> or other signing software to

a7aa94e0115a73841f34ebbfa00f63fa1904e51fvboxsync determine when a key is to be published, whether it should be

a7aa94e0115a73841f34ebbfa00f63fa1904e51fvboxsync used for signing a zone, etc.

e91f2a55ed5a30342ec79ce273f3f4bad8283336vboxsync </para>

32bf313cd8c0de52ef27b486f15945c55c94b038vboxsync <para>

e66c95fa9950a4d9c567db63a4a495bf086cc4bfvboxsync If none of these options is set on the command line,

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync then <command>dnssec-settime</command> simply prints the key timing

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync metadata already stored in the key.

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync </para>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <para>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync When key metadata fields are changed, both files of a key

e91f2a55ed5a30342ec79ce273f3f4bad8283336vboxsync pair (<filename>Knnnn.+aaa+iiiii.key</filename> and

bec9452711598b56e648192360cab88a6c3535e8vboxsync <filename>Knnnn.+aaa+iiiii.private</filename>) are regenerated.

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync Metadata fields are stored in the private file. A human-readable

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync description of the metadata is also placed in comments in the key

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync file. The private file's permissions are always set to be

683eff3070b1b86fe71b71af7fda82766ea19d17vboxsync inaccessible to anyone other than the owner (mode 0600).

683eff3070b1b86fe71b71af7fda82766ea19d17vboxsync </para>

d1c36fd86d36726777e3d6f9d040573e0aaf30devboxsync </refsection>

d1c36fd86d36726777e3d6f9d040573e0aaf30devboxsync

ab455939477d81b7bb500586f88029d3a3c0b34cvboxsync <refsection><info><title>OPTIONS</title></info>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync

d94da006d266643454eaeeb7e54c7c4a06bff515vboxsync

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <variablelist>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <varlistentry>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <term>-f</term>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <listitem>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync <para>

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync Force an update of an old-format key with no metadata fields.

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync Without this option, <command>dnssec-settime</command> will

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync fail when attempting to update a legacy key. With this option,

d67d8d3162b0d9cac99842fc7da74e8371453046vboxsync the key will be recreated in the new format, but with the

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync original key data retained. The key's creation date will be

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync set to the present time. If no other values are specified,

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync then the key's publication and activation dates will also

2f655f58f4f10aed9b9b07d1379093ef469ba682vboxsync be set to the present time.

2f655f58f4f10aed9b9b07d1379093ef469ba682vboxsync </para>

2f655f58f4f10aed9b9b07d1379093ef469ba682vboxsync </listitem>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync </varlistentry>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <varlistentry>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <term>-K <replaceable class="parameter">directory</replaceable></term>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <listitem>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <para>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync Sets the directory in which the key files are to reside.

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync </para>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync </listitem>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync </varlistentry>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync

b39c3fa81cadaec00ebb2e7170a8db96998b7032vboxsync <varlistentry>

b39c3fa81cadaec00ebb2e7170a8db96998b7032vboxsync <term>-L <replaceable class="parameter">ttl</replaceable></term>

b39c3fa81cadaec00ebb2e7170a8db96998b7032vboxsync <listitem>

b39c3fa81cadaec00ebb2e7170a8db96998b7032vboxsync <para>

b39c3fa81cadaec00ebb2e7170a8db96998b7032vboxsync Sets the default TTL to use for this key when it is converted

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync into a DNSKEY RR. If the key is imported into a zone,

2f655f58f4f10aed9b9b07d1379093ef469ba682vboxsync this is the TTL that will be used for it, unless there was

2f655f58f4f10aed9b9b07d1379093ef469ba682vboxsync already a DNSKEY RRset in place, in which case the existing TTL

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync would take precedence. If this value is not set and there

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync is no existing DNSKEY RRset, the TTL will default to the

f1630a6818621238c9c2338394b44995e318e108vboxsync SOA TTL. Setting the default TTL to <literal>0</literal>

f1630a6818621238c9c2338394b44995e318e108vboxsync or <literal>none</literal> removes it from the key.

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync </para>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync </listitem>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync </varlistentry>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <varlistentry>

37136b5ecb07042e5ba50f86849a79d1cba5d5f1vboxsync <term>-h</term>

c14daac2bac51584dd4b94bf9ab51ed5b6f654aavboxsync <listitem>

715e49c31b15c23c17a9ce3be42a75e7c48d4b78vboxsync <para>

715e49c31b15c23c17a9ce3be42a75e7c48d4b78vboxsync Emit usage message and exit.

715e49c31b15c23c17a9ce3be42a75e7c48d4b78vboxsync </para>

715e49c31b15c23c17a9ce3be42a75e7c48d4b78vboxsync </listitem>

715e49c31b15c23c17a9ce3be42a75e7c48d4b78vboxsync </varlistentry>

715e49c31b15c23c17a9ce3be42a75e7c48d4b78vboxsync

<varlistentry>

<term>-V</term>

<listitem>

<para>

Prints version information.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-v <replaceable class="parameter">level</replaceable></term>

<listitem>

<para>

Sets the debugging level.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-E <replaceable class="parameter">engine</replaceable></term>

<listitem>

<para>

Specifies the cryptographic hardware to use, when applicable.

</para>

<para>

When BIND is built with OpenSSL PKCS#11 support, this defaults

to the string "pkcs11", which identifies an OpenSSL engine

that can drive a cryptographic accelerator or hardware service

module. When BIND is built with native PKCS#11 cryptography

(--enable-native-pkcs11), it defaults to the path of the PKCS#11

provider library specified via "--with-pkcs11".

</para>

</listitem>

</varlistentry>

</variablelist>

</refsection>

<refsection><info><title>TIMING OPTIONS</title></info>

<para>

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.

If the argument begins with a '+' or '-', it is interpreted as

an offset from the present time. For convenience, if such an offset

is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',

then the offset is computed in years (defined as 365 24-hour days,

ignoring leap years), months (defined as 30 24-hour days), weeks,

days, hours, or minutes, respectively. Without a suffix, the offset

is computed in seconds. To unset a date, use 'none' or 'never'.

</para>

<variablelist>

<varlistentry>

<term>-P <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which a key is to be published to the zone.

After that date, the key will be included in the zone but will

not be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-P sync <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which CDS and CDNSKEY records that match this

key are to be published to the zone.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-A <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be activated. After that

date, the key will be included in the zone and used to sign

it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-R <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be revoked. After that

date, the key will be flagged as revoked. It will be included

in the zone and will be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-I <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be retired. After that

date, the key will still be included in the zone, but it

will not be used to sign it.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-D <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the key is to be deleted. After that

date, the key will no longer be included in the zone. (It

may remain in the key repository, however.)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-D sync <replaceable class="parameter">date/offset</replaceable></term>

<listitem>

<para>

Sets the date on which the CDS and CDNSKEY records that match this

key are to be deleted.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-S <replaceable class="parameter">predecessor key</replaceable></term>

<listitem>

<para>

Select a key for which the key being modified will be an

explicit successor. The name, algorithm, size, and type of the

predecessor key must exactly match those of the key being

modified. The activation date of the successor key will be set

to the inactivation date of the predecessor. The publication

date will be set to the activation date minus the prepublication

interval, which defaults to 30 days.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-i <replaceable class="parameter">interval</replaceable></term>

<listitem>

<para>

Sets the prepublication interval for a key. If set, then

the publication and activation dates must be separated by at least

this much time. If the activation date is specified but the

publication date isn't, then the publication date will default

to this much time before the activation date; conversely, if

the publication date is specified but activation date isn't,

then activation will be set to this much time after publication.

</para>

<para>

If the key is being set to be an explicit successor to another

key, then the default prepublication interval is 30 days;

otherwise it is zero.

</para>

<para>

As with date offsets, if the argument is followed by one of

the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the

interval is measured in years, months, weeks, days, hours,

or minutes, respectively. Without a suffix, the interval is

measured in seconds.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsection>

<refsection><info><title>PRINTING OPTIONS</title></info>

<para>

<command>dnssec-settime</command> can also be used to print the

timing metadata associated with a key.

</para>

<variablelist>

<varlistentry>

<term>-u</term>

<listitem>

<para>

Print times in UNIX epoch format.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-p <replaceable class="parameter">C/P/Psync/A/R/I/D/Dsync/all</replaceable></term>

<listitem>

<para>

Print a specific metadata value or set of metadata values.

The <option>-p</option> option may be followed by one or more

of the following letters or strings to indicate which value

or values to print:

<option>C</option> for the creation date,

<option>P</option> for the publication date,

<option>Psync</option> for the CDS and CDNSKEY publication date,

<option>A</option> for the activation date,

<option>R</option> for the revocation date,

<option>I</option> for the inactivation date,

<option>D</option> for the deletion date, and

<option>Dsync</option> for the CDS and CDNSKEY deletion date

To print all of the metadata, use <option>-p all</option>.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsection>

<refsection><info><title>SEE ALSO</title></info>

<para><citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citerefentry>

<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citetitle>BIND 9 Administrator Reference Manual</citetitle>,

<citetitle>RFC 5011</citetitle>.

</para>

</refsection>

</refentry>