dnssec-signkey.html revision 8a66318e41ed14c5a88130e8c362610e8faa2121
6238N/A<!--
6238N/A - Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
6238N/A - Copyright (C) 2001, 2003 Internet Software Consortium.
6238N/A -
6238N/A - Permission to use, copy, modify, and distribute this software for any
6238N/A - purpose with or without fee is hereby granted, provided that the above
6238N/A - copyright notice and this permission notice appear in all copies.
6238N/A -
6983N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
6983N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
6238N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
6238N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
6238N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
6238N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
6983N/A - PERFORMANCE OF THIS SOFTWARE.
6983N/A-->
6983N/A
6983N/A<!-- $Id: dnssec-signkey.html,v 1.5 2004/03/05 08:32:16 marka Exp $ -->
6238N/A
6238N/A<HTML
6238N/A><HEAD
6238N/A><TITLE
6238N/A>dnssec-signkey</TITLE
6238N/A><META
6238N/ANAME="GENERATOR"
6238N/ACONTENT="Modular DocBook HTML Stylesheet Version 1.61
6238N/A"></HEAD
6238N/A><BODY
6238N/ACLASS="REFENTRY"
6238N/ABGCOLOR="#FFFFFF"
6238N/ATEXT="#000000"
6238N/ALINK="#0000FF"
6238N/AVLINK="#840084"
6238N/AALINK="#0000FF"
6238N/A><H1
6238N/A><A
6238N/ANAME="AEN1"
6238N/A><SPAN
6238N/ACLASS="APPLICATION"
6238N/A>dnssec-signkey</SPAN
6238N/A></A
6238N/A></H1
6238N/A><DIV
6238N/ACLASS="REFNAMEDIV"
6238N/A><A
6238N/ANAME="AEN9"
6238N/A></A
6238N/A><H2
6238N/A>Name</H2
6238N/A><SPAN
6238N/ACLASS="APPLICATION"
6238N/A>dnssec-signkey</SPAN
6238N/A>&nbsp;--&nbsp;DNSSEC key set signing tool</DIV
6238N/A><DIV
6238N/ACLASS="REFSYNOPSISDIV"
6238N/A><A
6238N/ANAME="AEN13"
6238N/A></A
6238N/A><H2
6238N/A>Synopsis</H2
6238N/A><P
6238N/A><B
6238N/ACLASS="COMMAND"
6238N/A>dnssec-signkey</B
6238N/A> [<TT
6238N/ACLASS="OPTION"
6238N/A>-a</TT
6238N/A>] [<TT
6238N/ACLASS="OPTION"
6238N/A>-c <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>class</I
6238N/A></TT
6238N/A></TT
6238N/A>] [<TT
6238N/ACLASS="OPTION"
6238N/A>-s <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>start-time</I
6238N/A></TT
6238N/A></TT
6238N/A>] [<TT
6238N/ACLASS="OPTION"
6238N/A>-e <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>end-time</I
6238N/A></TT
6238N/A></TT
6238N/A>] [<TT
6238N/ACLASS="OPTION"
6238N/A>-h</TT
6238N/A>] [<TT
6238N/ACLASS="OPTION"
6238N/A>-p</TT
6238N/A>] [<TT
6238N/ACLASS="OPTION"
6718N/A>-r <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>randomdev</I
6238N/A></TT
6718N/A></TT
6238N/A>] [<TT
6238N/ACLASS="OPTION"
6238N/A>-v <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>level</I
6238N/A></TT
6238N/A></TT
6238N/A>] {keyset} {key...}</P
6238N/A></DIV
6238N/A><DIV
6238N/ACLASS="REFSECT1"
6238N/A><A
6238N/ANAME="AEN39"
6238N/A></A
6238N/A><H2
6238N/A>DESCRIPTION</H2
6238N/A><P
6238N/A> <B
6238N/ACLASS="COMMAND"
6238N/A>dnssec-signkey</B
6238N/A> signs a keyset. Typically
6238N/A the keyset will be for a child zone, and will have been generated
6238N/A by <B
6238N/ACLASS="COMMAND"
6238N/A>dnssec-makekeyset</B
6238N/A>. The child zone's keyset
6238N/A is signed with the zone keys for its parent zone. The output file
6238N/A is of the form <TT
6238N/ACLASS="FILENAME"
6238N/A>signedkey-nnnn.</TT
6238N/A>, where
6238N/A <TT
6238N/ACLASS="FILENAME"
6238N/A>nnnn</TT
6238N/A> is the zone name.
6238N/A </P
6238N/A></DIV
6238N/A><DIV
6238N/ACLASS="REFSECT1"
6238N/A><A
6238N/ANAME="AEN46"
6238N/A></A
6238N/A><H2
6238N/A>OPTIONS</H2
6238N/A><P
6238N/A></P
6238N/A><DIV
6238N/ACLASS="VARIABLELIST"
6238N/A><DL
6718N/A><DT
6238N/A>-a</DT
6238N/A><DD
6238N/A><P
6718N/A> Verify all generated signatures.
6238N/A </P
6238N/A></DD
6238N/A><DT
6238N/A>-c <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>class</I
6238N/A></TT
6238N/A></DT
6238N/A><DD
6238N/A><P
6238N/A> Specifies the DNS class of the key sets.
6238N/A </P
6238N/A></DD
6238N/A><DT
6238N/A>-s <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>start-time</I
6238N/A></TT
6238N/A></DT
6238N/A><DD
6238N/A><P
6238N/A> Specify the date and time when the generated SIG records
6718N/A become valid. This can be either an absolute or relative
6238N/A time. An absolute start time is indicated by a number
6238N/A in YYYYMMDDHHMMSS notation; 20000530144500 denotes
6238N/A 14:45:00 UTC on May 30th, 2000. A relative start time is
6238N/A indicated by +N, which is N seconds from the current time.
6238N/A If no <TT
6238N/ACLASS="OPTION"
6238N/A>start-time</TT
6238N/A> is specified, the current
6718N/A time is used.
6238N/A </P
6238N/A></DD
6238N/A><DT
6238N/A>-e <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>end-time</I
6238N/A></TT
6238N/A></DT
6238N/A><DD
6238N/A><P
6238N/A> Specify the date and time when the generated SIG records
6238N/A expire. As with <TT
6238N/ACLASS="OPTION"
6238N/A>start-time</TT
6238N/A>, an absolute
6238N/A time is indicated in YYYYMMDDHHMMSS notation. A time relative
6238N/A to the start time is indicated with +N, which is N seconds from
6718N/A the start time. A time realtive to the current time is
6238N/A indicated with now+N. If no <TT
6238N/ACLASS="OPTION"
6238N/A>end-time</TT
6238N/A> is
6238N/A specified, 30 days from the start time is used as a default.
6238N/A </P
6238N/A></DD
6238N/A><DT
6718N/A>-h</DT
6238N/A><DD
6238N/A><P
6238N/A> Prints a short summary of the options and arguments to
6238N/A <B
6238N/ACLASS="COMMAND"
6238N/A>dnssec-signkey</B
6238N/A>.
6238N/A </P
6238N/A></DD
6238N/A><DT
6238N/A>-p</DT
6718N/A><DD
6238N/A><P
6238N/A> Use pseudo-random data when signing the zone. This is faster,
6238N/A but less secure, than using real random data. This option
6238N/A may be useful when signing large zones or when the entropy
6238N/A source is limited.
6238N/A </P
6238N/A></DD
6238N/A><DT
6238N/A>-r <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>randomdev</I
6238N/A></TT
6238N/A></DT
6238N/A><DD
6238N/A><P
6238N/A> Specifies the source of randomness. If the operating
6238N/A system does not provide a <TT
6238N/ACLASS="FILENAME"
6238N/A>/dev/random</TT
6238N/A>
6238N/A or equivalent device, the default source of randomness
6238N/A is keyboard input. <TT
6238N/ACLASS="FILENAME"
6238N/A>randomdev</TT
6238N/A> specifies
6238N/A the name of a character device or file containing random
6238N/A data to be used instead of the default. The special value
6238N/A <TT
6238N/ACLASS="FILENAME"
6238N/A>keyboard</TT
6238N/A> indicates that keyboard
6238N/A input should be used.
6238N/A </P
6238N/A></DD
6238N/A><DT
6238N/A>-v <TT
6238N/ACLASS="REPLACEABLE"
6238N/A><I
6238N/A>level</I
6238N/A></TT
6238N/A></DT
6238N/A><DD
6238N/A><P
6238N/A> Sets the debugging level.
6238N/A </P
6238N/A></DD
6238N/A><DT
6238N/A>keyset</DT
6238N/A><DD
><P
> The file containing the child's keyset.
</P
></DD
><DT
>key</DT
><DD
><P
> The keys used to sign the child's keyset.
</P
></DD
></DL
></DIV
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN101"
></A
><H2
>EXAMPLE</H2
><P
> The DNS administrator for a DNSSEC-aware <TT
CLASS="USERINPUT"
><B
>.com</B
></TT
>
zone would use the following command to sign the
<TT
CLASS="FILENAME"
>keyset</TT
> file for <TT
CLASS="USERINPUT"
><B
>example.com</B
></TT
>
created by <B
CLASS="COMMAND"
>dnssec-makekeyset</B
> with a key generated
by <B
CLASS="COMMAND"
>dnssec-keygen</B
>:
</P
><P
> <TT
CLASS="USERINPUT"
><B
>dnssec-signkey keyset-example.com. Kcom.+003+51944</B
></TT
>
</P
><P
> In this example, <B
CLASS="COMMAND"
>dnssec-signkey</B
> creates
the file <TT
CLASS="FILENAME"
>signedkey-example.com.</TT
>, which
contains the <TT
CLASS="USERINPUT"
><B
>example.com</B
></TT
> keys and the
signatures by the <TT
CLASS="USERINPUT"
><B
>.com</B
></TT
> keys.
</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN116"
></A
><H2
>SEE ALSO</H2
><P
> <SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>dnssec-keygen</SPAN
>(8)</SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>dnssec-makekeyset</SPAN
>(8)</SPAN
>,
<SPAN
CLASS="CITEREFENTRY"
><SPAN
CLASS="REFENTRYTITLE"
>dnssec-signzone</SPAN
>(8)</SPAN
>.
</P
></DIV
><DIV
CLASS="REFSECT1"
><A
NAME="AEN128"
></A
><H2
>AUTHOR</H2
><P
> Internet Software Consortium
</P
></DIV
></BODY
></HTML
>