dnssec-signzone.docbook revision e174044290953a2499f574e35cc9c22ba126a303
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews [<!ENTITY mdash "—">]>
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington - Copyright (C) 2000-2003 Internet Software Consortium.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Permission to use, copy, modify, and distribute this software for any
9016767f4e15191b7c763b8a4ad36a57dc2705a2Mark Andrews - purpose with or without fee is hereby granted, provided that the above
9016767f4e15191b7c763b8a4ad36a57dc2705a2Mark Andrews - copyright notice and this permission notice appear in all copies.
9016767f4e15191b7c763b8a4ad36a57dc2705a2Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
9016767f4e15191b7c763b8a4ad36a57dc2705a2Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
9016767f4e15191b7c763b8a4ad36a57dc2705a2Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
9016767f4e15191b7c763b8a4ad36a57dc2705a2Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
0b062f4990db5cc6db2fe3398926f71b92a67407Brian Wellington - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User<!-- $Id: dnssec-signzone.docbook,v 1.19 2005/06/28 02:55:09 marka Exp $ -->
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <refentryinfo>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </refentryinfo>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <refentrytitle><application>dnssec-signzone</application></refentrytitle>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <refname><application>dnssec-signzone</application></refname>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <refpurpose>DNSSEC zone signing tool</refpurpose>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </refnamediv>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <holder>Internet Software Consortium.</holder>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <refsynopsisdiv>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <cmdsynopsis>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-d <replaceable class="parameter">directory</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-e <replaceable class="parameter">end-time</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-f <replaceable class="parameter">output-file</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-k <replaceable class="parameter">key</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-j <replaceable class="parameter">jitter</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-n <replaceable class="parameter">nthreads</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </cmdsynopsis>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </refsynopsisdiv>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signs a zone. It generates
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User NSEC and RRSIG records and produces a signed version of the
ad671240d635376dd8681550eebee799d2e3d1fdAutomatic Updater zone. The security status of delegations from the signed zone
ad671240d635376dd8681550eebee799d2e3d1fdAutomatic Updater (that is, whether the child zones are secure or not) is
ad671240d635376dd8681550eebee799d2e3d1fdAutomatic Updater determined by the presence or absence of a
ad671240d635376dd8681550eebee799d2e3d1fdAutomatic Updater <filename>keyset</filename> file for each child zone.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <variablelist>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater Verify all generated signatures.
8e821eea5f57ac47a94305aa7ab0c3570d92a311Automatic Updater </varlistentry>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater <varlistentry>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater <term>-c <replaceable class="parameter">class</replaceable></term>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater Specifies the DNS class of the zone.
8e821eea5f57ac47a94305aa7ab0c3570d92a311Automatic Updater </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <term>-k <replaceable class="parameter">key</replaceable></term>
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater Treat specified key as a key signing key ignoring any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key flags. This option may be specified multiple times.
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-l <replaceable class="parameter">domain</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Generate a DLV set in addition to the key (DNSKEY) and DS sets.
8e821eea5f57ac47a94305aa7ab0c3570d92a311Automatic Updater The domain is appended to the name of the records.
8e821eea5f57ac47a94305aa7ab0c3570d92a311Automatic Updater </varlistentry>
aaaf8d4f4873d21e55c3ffb4f656203d08339865Mark Andrews <varlistentry>
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt <term>-d <replaceable class="parameter">directory</replaceable></term>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater Look for <filename>keyset</filename> files in
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater </varlistentry>
b272d38cc5d24f64c0647a9afb340c21c4b9aaf7Evan Hunt <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User Generate DS records for child zones from keyset files.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Existing DS records will be removed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
2f8d63983c297c62630044d28a6f66676b4d339dMark Andrews <varlistentry>
2f8d63983c297c62630044d28a6f66676b4d339dMark Andrews <term>-s <replaceable class="parameter">start-time</replaceable></term>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater Specify the date and time when the generated RRSIG records
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User become valid. This can be either an absolute or relative
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User time. An absolute start time is indicated by a number
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater in YYYYMMDDHHMMSS notation; 20000530144500 denotes
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater 14:45:00 UTC on May 30th, 2000. A relative start time is
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater indicated by +N, which is N seconds from the current time.
aaaf8d4f4873d21e55c3ffb4f656203d08339865Mark Andrews If no <option>start-time</option> is specified, the current
aaaf8d4f4873d21e55c3ffb4f656203d08339865Mark Andrews time minus 1 hour (to allow for clock skew) is used.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <term>-e <replaceable class="parameter">end-time</replaceable></term>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater Specify the date and time when the generated RRSIG records
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater expire. As with <option>start-time</option>, an absolute
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater time is indicated in YYYYMMDDHHMMSS notation. A time relative
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater to the start time is indicated with +N, which is N seconds from
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater the start time. A time relative to the current time is
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User indicated with now+N. If no <option>end-time</option> is
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User specified, 30 days from the start time is used as a default.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <term>-f <replaceable class="parameter">output-file</replaceable></term>
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User The name of the output file containing the signed zone. The
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User default is to append <filename>.signed</filename> to
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User </varlistentry>
6ea2385360e9e2167e65f9286447da9eea189457Tinderbox User <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User Prints a short summary of the options and arguments to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <term>-i <replaceable class="parameter">interval</replaceable></term>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User When a previously signed zone is passed as input, records
f8e3e03cacd16ffb923a9603fca23a9e1a1fee07Automatic Updater may be resigned. The <option>interval</option> option
f8e3e03cacd16ffb923a9603fca23a9e1a1fee07Automatic Updater specifies the cycle interval as an offset from the current
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User time (in seconds). If a RRSIG record expires after the
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User cycle interval, it is retained. Otherwise, it is considered
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to be expiring soon, and it will be replaced.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The default cycle interval is one quarter of the difference
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein between the signature end and start times. So if neither
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <option>end-time</option> or <option>start-time</option>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are specified, <command>dnssec-signzone</command>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User signatures that are valid for 30 days, with a cycle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interval of 7.5 days. Therefore, if any existing RRSIG records
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User are due to expire in less than 7.5 days, they would be
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <term>-I <replaceable class="parameter">input-format</replaceable></term>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User The format of the input zone file.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User Possible formats are <command>"text"</command> (default)
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User This option is primarily intended to be used for dynamic
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User signed zones so that the dumped zone file in a non-text
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater format containing updates can be signed directly.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User The use of this option does not make much sense for
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User non-dynamic zones.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
a3f8c8e20780e488141d200acdfea6c5f3303513Automatic Updater <varlistentry>
a3f8c8e20780e488141d200acdfea6c5f3303513Automatic Updater <term>-j <replaceable class="parameter">jitter</replaceable></term>
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User When signing a zone with a fixed signature lifetime, all
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User RRSIG records issued at the time of signing expires
ef8014e56f35bb36daa5fd2c313f5e7963e97aa1Tinderbox User simultaneously. If the zone is incrementally signed, i.e.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User a previously signed zone is passed as input to the signer,
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User all expired signatures has to be regenerated at about the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same time. The <option>jitter</option> option specifies a
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User jitter window that will be used to randomize the signature
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User expire time, thus spreading incremental signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein regeneration over time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Signature lifetime jitter also to some extent benefits
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User validators and servers by spreading out cache expiration,
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User i.e. if large numbers of RRSIGs don't expire at the same time
575e15fed997a3ad1cb35c5b9ef34ab24ce47e72Automatic Updater from all caches there will be less congestion than if all
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User validators need to refetch at mostly the same time.
575e15fed997a3ad1cb35c5b9ef34ab24ce47e72Automatic Updater </varlistentry>
575e15fed997a3ad1cb35c5b9ef34ab24ce47e72Automatic Updater <varlistentry>
575e15fed997a3ad1cb35c5b9ef34ab24ce47e72Automatic Updater <term>-n <replaceable class="parameter">ncpus</replaceable></term>
575e15fed997a3ad1cb35c5b9ef34ab24ce47e72Automatic Updater Specifies the number of threads to use. By default, one
575e15fed997a3ad1cb35c5b9ef34ab24ce47e72Automatic Updater thread is started for each detected CPU.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <term>-o <replaceable class="parameter">origin</replaceable></term>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The zone origin. If not specified, the name of the zone file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is assumed to be the origin.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <term>-O <replaceable class="parameter">output-format</replaceable></term>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater The format of the output file containing the signed zone.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User Possible formats are <command>"text"</command> (default)
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater </varlistentry>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User Use pseudo-random data when signing the zone. This is faster,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein but less secure, than using real random data. This option
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User may be useful when signing large zones or when the entropy
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User source is limited.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater <term>-r <replaceable class="parameter">randomdev</replaceable></term>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater Specifies the source of randomness. If the operating
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater system does not provide a <filename>/dev/random</filename>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater or equivalent device, the default source of randomness
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater is keyboard input. <filename>randomdev</filename>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater the name of a character device or file containing random
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater data to be used instead of the default. The special value
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater <filename>keyboard</filename> indicates that keyboard
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater input should be used.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Print statistics at completion.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <term>-v <replaceable class="parameter">level</replaceable></term>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User Sets the debugging level.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User Ignore KSK flag on key when determining what to sign.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <varlistentry>
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater The file containing the zone to be signed.
2895f101b5585a19015ac2c2c1e1812ac467fa12Automatic Updater </varlistentry>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User <varlistentry>
0a7ed88633a680bb881868b75ded4d09a7bbbc50Automatic Updater The keys used to sign the zone. If no keys are specified, the
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User default all zone keys that have private key files in the
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User current directory.
f8e3e03cacd16ffb923a9603fca23a9e1a1fee07Automatic Updater </varlistentry>
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User </variablelist>
5a24d24c8fba3480d707c0c902379ddb36501e12Automatic Updater The following command signs the <userinput>example.com</userinput>
f8e3e03cacd16ffb923a9603fca23a9e1a1fee07Automatic Updater zone with the DSA key generated in the <command>dnssec-keygen</command>
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User man page. The zone's keys must be in the zone. If there are
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User <filename>keyset</filename> files associated with child
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User they must be in the current directory.
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <userinput>example.com</userinput>, the following command would be
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <para><userinput>dnssec-signzone -o example.com db.example.com
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User The command would print a string of the form:
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User In this example, <command>dnssec-signzone</command> creates
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User the file <filename>db.example.com.signed</filename>. This
f8e3e03cacd16ffb923a9603fca23a9e1a1fee07Automatic Updater should be referenced in a zone statement in a
f8e3e03cacd16ffb923a9603fca23a9e1a1fee07Automatic Updater <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
f8e3e03cacd16ffb923a9603fca23a9e1a1fee07Automatic Updater </citerefentry>,
2eeb74d1cf5355dd98f6d507a10086e16bb08c4bTinderbox User <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater <para><corpauthor>Internet Systems Consortium</corpauthor>
3acf5eb97cebc2ba868e6ac4a4e01e6d1be0c892Automatic Updater - Local variables: