dnssec-signzone.docbook revision 61271cdee65f3313e98f382b07e6674861d9020a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
990d0e893f5b70e735cdf990af66e9ec6e91fa78Tinderbox User "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews [<!ENTITY mdash "—">]>
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2000-2003 Internet Software Consortium.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Permission to use, copy, modify, and/or distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id: dnssec-signzone.docbook,v 1.45 2011/03/04 22:20:20 each Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentryinfo>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </refentryinfo>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentrytitle><application>dnssec-signzone</application></refentrytitle>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refnamediv>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refname><application>dnssec-signzone</application></refname>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refpurpose>DNSSEC zone signing tool</refpurpose>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </refnamediv>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </copyright>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </copyright>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refsynopsisdiv>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <cmdsynopsis>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-d <replaceable class="parameter">directory</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-e <replaceable class="parameter">end-time</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-f <replaceable class="parameter">output-file</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-k <replaceable class="parameter">key</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-j <replaceable class="parameter">jitter</replaceable></option></arg>
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User <arg><option>-N <replaceable class="parameter">soa-serial-format</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
78ec962d9828200d18cd0e41b7d6b9792a74923dTinderbox User <arg><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
a1ad6695ed6f988406cf155aa26376f84f73bcb9Automatic Updater <arg><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
78ec962d9828200d18cd0e41b7d6b9792a74923dTinderbox User <arg><option>-X <replaceable class="parameter">extended end-time</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <arg><option>-3 <replaceable class="parameter">salt</replaceable></option></arg>
78ec962d9828200d18cd0e41b7d6b9792a74923dTinderbox User <arg><option>-H <replaceable class="parameter">iterations</replaceable></option></arg>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </cmdsynopsis>
78ec962d9828200d18cd0e41b7d6b9792a74923dTinderbox User </refsynopsisdiv>
78ec962d9828200d18cd0e41b7d6b9792a74923dTinderbox User signs a zone. It generates
78ec962d9828200d18cd0e41b7d6b9792a74923dTinderbox User NSEC and RRSIG records and produces a signed version of the
78ec962d9828200d18cd0e41b7d6b9792a74923dTinderbox User zone. The security status of delegations from the signed zone
7208386cd37a2092c70eddf80cf29519b16c4c80Mark Andrews (that is, whether the child zones are secure or not) is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determined by the presence or absence of a
507151045be68c671ffd4e2f37e17cdfa0376fc4Automatic Updater <filename>keyset</filename> file for each child zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <variablelist>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews <varlistentry>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews Verify all generated signatures.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-c <replaceable class="parameter">class</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the DNS class of the zone.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Compatibility mode: Generate a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <filename>keyset-<replaceable>zonename</replaceable></filename>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file in addition to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <filename>dsset-<replaceable>zonename</replaceable></filename>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when signing a zone, for use by older versions of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-d <replaceable class="parameter">directory</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <filename>keyset-</filename> files in <option>directory</option>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-E <replaceable class="parameter">engine</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Uses a crypto hardware (OpenSSL engine) for the crypto operations
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it supports, for instance signing with private keys from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a secure key store. When compiled with PKCS#11 support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it defaults to pkcs11; the empty name resets it to no engine.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Generate DS records for child zones from
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <filename>dsset-</filename> or <filename>keyset-</filename>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews file. Existing DS records will be removed.
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews </varlistentry>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <term>-K <replaceable class="parameter">directory</replaceable></term>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews Key repository: Specify a directory to search for DNSSEC keys.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If not specified, defaults to the current directory.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-k <replaceable class="parameter">key</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Treat specified key as a key signing key ignoring any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key flags. This option may be specified multiple times.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater <varlistentry>
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater <term>-l <replaceable class="parameter">domain</replaceable></term>
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater Generate a DLV set in addition to the key (DNSKEY) and DS sets.
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater The domain is appended to the name of the records.
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater </varlistentry>
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater <varlistentry>
afb33f777af856f8c3382604a7a8ffdfe2b512c5Automatic Updater <term>-s <replaceable class="parameter">start-time</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein become valid. This can be either an absolute or relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time. An absolute start time is indicated by a number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in YYYYMMDDHHMMSS notation; 20000530144500 denotes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 14:45:00 UTC on May 30th, 2000. A relative start time is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicated by +N, which is N seconds from the current time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If no <option>start-time</option> is specified, the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time minus 1 hour (to allow for clock skew) is used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-e <replaceable class="parameter">end-time</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire. As with <option>start-time</option>, an absolute
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the start time is indicated with +N, which is N seconds from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the start time. A time relative to the current time is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicated with now+N. If no <option>end-time</option> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified, 30 days from the start time is used as a default.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-X <replaceable class="parameter">extended end-time</replaceable></term>
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews Specify the date and time when the generated RRSIG records
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews for the DNSKEY RRset will expire. This is to be used in cases
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews when the DNSKEY signatures need to persist longer than
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews signatures on other records; e.g., when the private component
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews of the KSK is kept offline and the KSK signature is to be
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews refreshed manually.
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews As with <option>start-time</option>, an absolute
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews to the start time is indicated with +N, which is N seconds from
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews the start time. A time relative to the current time is
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews indicated with now+N. If no <option>extended end-time</option> is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specified, the value of <option>end-time</option> is used as
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews the default. (<option>end-time</option>, in turn, defaults to
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews 30 days from the start time.) <option>extended end-time</option>
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews must be later than <option>start-time</option>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-f <replaceable class="parameter">output-file</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The name of the output file containing the signed zone. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default is to append <filename>.signed</filename> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein input filename.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User <varlistentry>
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User Prints a short summary of the options and arguments to
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User </varlistentry>
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User <varlistentry>
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User <term>-i <replaceable class="parameter">interval</replaceable></term>
3a32ac2a720653083c7a22cb654b86c398f6d4c8Tinderbox User When a previously-signed zone is passed as input, records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein may be resigned. The <option>interval</option> option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein specifies the cycle interval as an offset from the current
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time (in seconds). If a RRSIG record expires after the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cycle interval, it is retained. Otherwise, it is considered
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be expiring soon, and it will be replaced.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default cycle interval is one quarter of the difference
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews between the signature end and start times. So if neither
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <option>end-time</option> or <option>start-time</option>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are specified, <command>dnssec-signzone</command>
b05bdb520d83f7ecaad708fe305268c3420be01dMark Andrews signatures that are valid for 30 days, with a cycle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interval of 7.5 days. Therefore, if any existing RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are due to expire in less than 7.5 days, they would be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-I <replaceable class="parameter">input-format</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The format of the input zone file.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Possible formats are <command>"text"</command> (default)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This option is primarily intended to be used for dynamic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signed zones so that the dumped zone file in a non-text
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein format containing updates can be signed directly.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The use of this option does not make much sense for
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein non-dynamic zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews <varlistentry>
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews <term>-j <replaceable class="parameter">jitter</replaceable></term>
ceeb18e6907a10547859faa340ecad83bedae90cMark Andrews When signing a zone with a fixed signature lifetime, all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIG records issued at the time of signing expires
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein simultaneously. If the zone is incrementally signed, i.e.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a previously-signed zone is passed as input to the signer,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein all expired signatures have to be regenerated at about the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same time. The <option>jitter</option> option specifies a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein jitter window that will be used to randomize the signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire time, thus spreading incremental signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein regeneration over time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Signature lifetime jitter also to some extent benefits
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validators and servers by spreading out cache expiration,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein i.e. if large numbers of RRSIGs don't expire at the same time
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from all caches there will be less congestion than if all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validators need to refetch at mostly the same time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-n <replaceable class="parameter">ncpus</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the number of threads to use. By default, one
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein thread is started for each detected CPU.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-N <replaceable class="parameter">soa-serial-format</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The SOA serial number format of the signed zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Possible formats are <command>"keep"</command> (default),
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <variablelist>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <para>Do not modify the SOA serial number.</para>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <para>Increment the SOA serial number using RFC 1982
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein arithmetics.</para>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <para>Set the SOA serial number to the number of seconds
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater since epoch.</para>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater </varlistentry>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater </variablelist>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater </varlistentry>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater <varlistentry>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater <term>-o <replaceable class="parameter">origin</replaceable></term>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater The zone origin. If not specified, the name of the zone file
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater is assumed to be the origin.
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater </varlistentry>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater <varlistentry>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater <term>-O <replaceable class="parameter">output-format</replaceable></term>
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater The format of the output file containing the signed zone.
984c2e9f76e66e86f7d9aca99a774836ddf196eaAutomatic Updater Possible formats are <command>"text"</command> (default)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use pseudo-random data when signing the zone. This is faster,
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User but less secure, than using real random data. This option
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User may be useful when signing large zones or when the entropy
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User source is limited.
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User </varlistentry>
bae169ea64bf736d6ea6074c2af3d7c117079972Tinderbox User <varlistentry>
bae169ea64bf736d6ea6074c2af3d7c117079972Tinderbox User Disable post sign verification tests.
bae169ea64bf736d6ea6074c2af3d7c117079972Tinderbox User The post sign verification test ensures that for each algorithm
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User in use there is at least one non revoked self signed KSK key,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that all revoked KSK keys are self signed, and that all records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in the zone are signed by the algorithm.
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User This option skips these tests.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews </varlistentry>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <varlistentry>
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User <term>-r <replaceable class="parameter">randomdev</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the source of randomness. If the operating
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein system does not provide a <filename>/dev/random</filename>
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User or equivalent device, the default source of randomness
bae169ea64bf736d6ea6074c2af3d7c117079972Tinderbox User is keyboard input. <filename>randomdev</filename>
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User the name of a character device or file containing random
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User data to be used instead of the default. The special value
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User <filename>keyboard</filename> indicates that keyboard
dad65f7c93330a10705384739dff3a6d4dfe1e70Tinderbox User input should be used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Smart signing: Instructs <command>dnssec-signzone</command> to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein search the key repository for keys that match the zone being
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signed, and to include them in the zone if appropriate.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When a key is found, its timing metadata is examined to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determine how it should be used, according to the following
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein rules. Each successive rule takes priority over the prior
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <variablelist>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If no timing metadata has been set for the key, the key is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein published in the zone and used to sign the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If the key's publication date is set and is in the past, the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key is published in the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If the key's activation date is set and in the past, the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key is published (regardless of publication date) and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein used to sign the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If the key's revocation date is set and in the past, and the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key is published, then the key is revoked, and the revoked key
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User is used to sign the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein If either of the key's unpublication or deletion dates are set
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and in the past, the key is NOT published or used to sign the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone, regardless of any other metadata.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </variablelist>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-T <replaceable class="parameter">ttl</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specifies the TTL to be used for new DNSKEY records imported
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews into the zone from the key repository. If not specified,
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews the default is the minimum TTL value from the zone's SOA
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein record. This option is ignored when signing without
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <option>-S</option>, since DNSKEY records are not imported
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from the key repository in that case. It is also ignored if
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there are any pre-existing DNSKEY records at the zone apex,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in which case new records' TTL values will be set to match
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews <varlistentry>
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews Print statistics at completion.
9c6a5d1f22f972232d7a9fd5c5fa64f10bacbdffAutomatic Updater </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews Update NSEC/NSEC3 chain when re-signing a previously signed
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews zone. With this option, a zone signed with NSEC can be
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews switched to NSEC3, or a zone signed with NSEC3 can
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews be switch to NSEC or to NSEC3 with different parameters.
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews Without this option, <command>dnssec-signzone</command> will
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews retain the existing chain when re-signing.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews <varlistentry>
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews <term>-v <replaceable class="parameter">level</replaceable></term>
035992291cb70ec3be4046fcea921b4a6acb1c77Mark Andrews Sets the debugging level.
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater </varlistentry>
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews <varlistentry>
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews Only sign the DNSKEY RRset with key-signing keys, and omit
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews signatures from zone-signing keys. (This is similar to the
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews <command>dnssec-dnskey-kskonly yes;</command> zone option in
4556ad3a270bf049b3225433a402666aaffe3c36Mark Andrews </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Ignore KSK flag on key when determining what to sign. This
5fa6a064b8301e4f274bd132fd577def59e4fb4cTinderbox User causes KSK-flagged keys to sign all records, not just the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNSKEY RRset. (This is similar to the
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews <command>update-check-ksk no;</command> zone option in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-3 <replaceable class="parameter">salt</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Generate an NSEC3 chain with the given hex encoded salt.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews A dash (<replaceable class="parameter">salt</replaceable>) can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be used to indicate that no salt is to be used when generating the NSEC3 chain.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <varlistentry>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <term>-H <replaceable class="parameter">iterations</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When generating an NSEC3 chain, use this many interations. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default is 10.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When generating an NSEC3 chain set the OPTOUT flag on all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC3 records and do not generate NSEC3 records for insecure
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein delegations.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Using this option twice (i.e., <option>-AA</option>)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein turns the OPTOUT flag off for all records. This is useful
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein when using the <option>-u</option> option to modify an NSEC3
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein chain which previously had OPTOUT set.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The file containing the zone to be signed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Specify which keys should be used to sign the zone. If
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein no keys are specified, then the zone will be examined
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for DNSKEY records at the zone apex. If these are found and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein there are matching private keys, in the current directory,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce then these will be used for signing.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </variablelist>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The following command signs the <userinput>example.com</userinput>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone with the DSA key generated by <command>dnssec-keygen</command>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (Kexample.com.+003+17247). Because the <command>-S</command> option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is not being used, the zone's keys must be in the master file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (<filename>db.example.com</filename>). This invocation looks
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for <filename>dsset</filename> files, in the current directory,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce so that DS records can be imported from them (<command>-g</command>).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<programlisting>% dnssec-signzone -g -o example.com db.example.com \
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein%</programlisting>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein In the above example, <command>dnssec-signzone</command> creates
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the file <filename>db.example.com.signed</filename>. This
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein file should be referenced in a zone statement in a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein This example re-signs a previously signed zone with default parameters.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The private keys are assumed to be in the current directory.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<programlisting>% cp db.example.com.signed db.example.com
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein%</programlisting>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </citerefentry>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <para><corpauthor>Internet Systems Consortium</corpauthor>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Local variables:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - mode: sgml