dnssec-signzone.docbook revision 0e27506ce3135f9bd49e12564ad0e15256135118
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
40976ef802cadff62ef1e5c82cc7ed902e8ea1b9Automatic Updater "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
40976ef802cadff62ef1e5c82cc7ed902e8ea1b9Automatic Updater [<!ENTITY mdash "—">]>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - Copyright (C) 2000-2003 Internet Software Consortium.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - purpose with or without fee is hereby granted, provided that the above
40976ef802cadff62ef1e5c82cc7ed902e8ea1b9Automatic Updater - copyright notice and this permission notice appear in all copies.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
40976ef802cadff62ef1e5c82cc7ed902e8ea1b9Automatic Updater - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater - PERFORMANCE OF THIS SOFTWARE.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater<!-- $Id: dnssec-signzone.docbook,v 1.47 2011/03/05 23:52:29 tbox Exp $ -->
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <refentryinfo>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </refentryinfo>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <refentrytitle><application>dnssec-signzone</application></refentrytitle>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <refname><application>dnssec-signzone</application></refname>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <refpurpose>DNSSEC zone signing tool</refpurpose>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <holder>Internet Software Consortium.</holder>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <refsynopsisdiv>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-d <replaceable class="parameter">directory</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-e <replaceable class="parameter">end-time</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-f <replaceable class="parameter">output-file</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-k <replaceable class="parameter">key</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-j <replaceable class="parameter">jitter</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-N <replaceable class="parameter">soa-serial-format</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater <arg><option>-X <replaceable class="parameter">extended end-time</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-3 <replaceable class="parameter">salt</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <arg><option>-H <replaceable class="parameter">iterations</replaceable></option></arg>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </cmdsynopsis>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </refsynopsisdiv>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater signs a zone. It generates
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater NSEC and RRSIG records and produces a signed version of the
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater zone. The security status of delegations from the signed zone
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater (that is, whether the child zones are secure or not) is
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater determined by the presence or absence of a
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <filename>keyset</filename> file for each child zone.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <variablelist>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Verify all generated signatures.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-c <replaceable class="parameter">class</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Specifies the DNS class of the zone.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Compatibility mode: Generate a
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <filename>keyset-<replaceable>zonename</replaceable></filename>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater file in addition to
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <filename>dsset-<replaceable>zonename</replaceable></filename>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater when signing a zone, for use by older versions of
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-d <replaceable class="parameter">directory</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <filename>keyset-</filename> files in <option>directory</option>.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Output only those record types automatically managed by
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <command>dnssec-signzone</command>, i.e. RRSIG, NSEC,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater NSEC3 and NSEC3PARAM records. If smart signing
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater (<option>-S</option>) is used, DNSKEY records are also
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater included. The resulting file can be included in the original
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater zone file with <command>$INCLUDE</command>. This option
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater cannot be combined with <option>-O raw</option> or serial
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater number updating.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-E <replaceable class="parameter">engine</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Uses a crypto hardware (OpenSSL engine) for the crypto operations
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater it supports, for instance signing with private keys from
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater a secure key store. When compiled with PKCS#11 support
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater it defaults to pkcs11; the empty name resets it to no engine.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater Generate DS records for child zones from
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <filename>dsset-</filename> or <filename>keyset-</filename>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater file. Existing DS records will be removed.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-K <replaceable class="parameter">directory</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Key repository: Specify a directory to search for DNSSEC keys.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater If not specified, defaults to the current directory.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-k <replaceable class="parameter">key</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Treat specified key as a key signing key ignoring any
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater key flags. This option may be specified multiple times.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-l <replaceable class="parameter">domain</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Generate a DLV set in addition to the key (DNSKEY) and DS sets.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The domain is appended to the name of the records.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-s <replaceable class="parameter">start-time</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Specify the date and time when the generated RRSIG records
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater become valid. This can be either an absolute or relative
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater time. An absolute start time is indicated by a number
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater in YYYYMMDDHHMMSS notation; 20000530144500 denotes
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater 14:45:00 UTC on May 30th, 2000. A relative start time is
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater indicated by +N, which is N seconds from the current time.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater If no <option>start-time</option> is specified, the current
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater time minus 1 hour (to allow for clock skew) is used.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-e <replaceable class="parameter">end-time</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Specify the date and time when the generated RRSIG records
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater expire. As with <option>start-time</option>, an absolute
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater time is indicated in YYYYMMDDHHMMSS notation. A time relative
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater to the start time is indicated with +N, which is N seconds from
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater the start time. A time relative to the current time is
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater indicated with now+N. If no <option>end-time</option> is
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater specified, 30 days from the start time is used as a default.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <option>end-time</option> must be later than
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-X <replaceable class="parameter">extended end-time</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Specify the date and time when the generated RRSIG records
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater for the DNSKEY RRset will expire. This is to be used in cases
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater when the DNSKEY signatures need to persist longer than
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater signatures on other records; e.g., when the private component
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater of the KSK is kept offline and the KSK signature is to be
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater refreshed manually.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater As with <option>start-time</option>, an absolute
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater time is indicated in YYYYMMDDHHMMSS notation. A time relative
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater to the start time is indicated with +N, which is N seconds from
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater the start time. A time relative to the current time is
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater indicated with now+N. If no <option>extended end-time</option> is
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater specified, the value of <option>end-time</option> is used as
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater the default. (<option>end-time</option>, in turn, defaults to
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater 30 days from the start time.) <option>extended end-time</option>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater must be later than <option>start-time</option>.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater </varlistentry>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater <varlistentry>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater <term>-f <replaceable class="parameter">output-file</replaceable></term>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater The name of the output file containing the signed zone. The
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater default is to append <filename>.signed</filename> to
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater input filename.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Prints a short summary of the options and arguments to
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-i <replaceable class="parameter">interval</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater When a previously-signed zone is passed as input, records
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater may be resigned. The <option>interval</option> option
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater specifies the cycle interval as an offset from the current
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater time (in seconds). If a RRSIG record expires after the
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater cycle interval, it is retained. Otherwise, it is considered
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater to be expiring soon, and it will be replaced.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The default cycle interval is one quarter of the difference
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater between the signature end and start times. So if neither
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <option>end-time</option> or <option>start-time</option>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater are specified, <command>dnssec-signzone</command>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater signatures that are valid for 30 days, with a cycle
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater interval of 7.5 days. Therefore, if any existing RRSIG records
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater are due to expire in less than 7.5 days, they would be
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-I <replaceable class="parameter">input-format</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The format of the input zone file.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Possible formats are <command>"text"</command> (default)
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater This option is primarily intended to be used for dynamic
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater signed zones so that the dumped zone file in a non-text
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater format containing updates can be signed directly.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The use of this option does not make much sense for
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater non-dynamic zones.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-j <replaceable class="parameter">jitter</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater When signing a zone with a fixed signature lifetime, all
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater RRSIG records issued at the time of signing expires
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater simultaneously. If the zone is incrementally signed, i.e.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater a previously-signed zone is passed as input to the signer,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater all expired signatures have to be regenerated at about the
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater same time. The <option>jitter</option> option specifies a
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater jitter window that will be used to randomize the signature
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater expire time, thus spreading incremental signature
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater regeneration over time.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Signature lifetime jitter also to some extent benefits
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater validators and servers by spreading out cache expiration,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater i.e. if large numbers of RRSIGs don't expire at the same time
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater from all caches there will be less congestion than if all
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater validators need to refetch at mostly the same time.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-n <replaceable class="parameter">ncpus</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Specifies the number of threads to use. By default, one
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater thread is started for each detected CPU.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-N <replaceable class="parameter">soa-serial-format</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The SOA serial number format of the signed zone.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Possible formats are <command>"keep"</command> (default),
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <variablelist>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <para>Do not modify the SOA serial number.</para>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term><command>"increment"</command></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <para>Increment the SOA serial number using RFC 1982
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater arithmetics.</para>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term><command>"unixtime"</command></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <para>Set the SOA serial number to the number of seconds
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater since epoch.</para>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </variablelist>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-o <replaceable class="parameter">origin</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The zone origin. If not specified, the name of the zone file
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater is assumed to be the origin.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-O <replaceable class="parameter">output-format</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The format of the output file containing the signed zone.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Possible formats are <command>"text"</command> (default)
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater <varlistentry>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater Use pseudo-random data when signing the zone. This is faster,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater but less secure, than using real random data. This option
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater may be useful when signing large zones or when the entropy
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater source is limited.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Disable post sign verification tests.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater The post sign verification test ensures that for each algorithm
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater in use there is at least one non revoked self signed KSK key,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater that all revoked KSK keys are self signed, and that all records
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater in the zone are signed by the algorithm.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater This option skips these tests.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-r <replaceable class="parameter">randomdev</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Specifies the source of randomness. If the operating
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater system does not provide a <filename>/dev/random</filename>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater or equivalent device, the default source of randomness
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater is keyboard input. <filename>randomdev</filename>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater the name of a character device or file containing random
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater data to be used instead of the default. The special value
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <filename>keyboard</filename> indicates that keyboard
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater input should be used.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Smart signing: Instructs <command>dnssec-signzone</command> to
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater search the key repository for keys that match the zone being
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater signed, and to include them in the zone if appropriate.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater When a key is found, its timing metadata is examined to
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater determine how it should be used, according to the following
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater rules. Each successive rule takes priority over the prior
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <variablelist>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater If no timing metadata has been set for the key, the key is
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater published in the zone and used to sign the zone.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater If the key's publication date is set and is in the past, the
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater key is published in the zone.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater If the key's activation date is set and in the past, the
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater key is published (regardless of publication date) and
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater used to sign the zone.
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater If the key's revocation date is set and in the past, and the
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater key is published, then the key is revoked, and the revoked key
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater is used to sign the zone.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater If either of the key's unpublication or deletion dates are set
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater and in the past, the key is NOT published or used to sign the
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater zone, regardless of any other metadata.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </variablelist>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <term>-T <replaceable class="parameter">ttl</replaceable></term>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater Specifies the TTL to be used for new DNSKEY records imported
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater into the zone from the key repository. If not specified,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater the default is the minimum TTL value from the zone's SOA
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater record. This option is ignored when signing without
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <option>-S</option>, since DNSKEY records are not imported
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater from the key repository in that case. It is also ignored if
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater there are any pre-existing DNSKEY records at the zone apex,
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater in which case new records' TTL values will be set to match
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater <varlistentry>
Kexample.com.+003+17247