f1c89cb4f5c72c54bb67dc48cd6f2b332eab9e92Automatic Updater<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"

66ebd200f5ee9b6566e4390bd679beecb6bdcc6aTinderbox User "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

f1c89cb4f5c72c54bb67dc48cd6f2b332eab9e92Automatic Updater [<!ENTITY mdash "&#8212;">]>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt<refentry id="man.dnssec-signzone">

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refentryinfo>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <date>June 05, 2009</date>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </refentryinfo>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <refmeta>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <refentrytitle><application>dnssec-signzone</application></refentrytitle>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <manvolnum>8</manvolnum>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refmiscinfo>BIND9</refmiscinfo>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </refmeta>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refnamediv>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refname><application>dnssec-signzone</application></refname>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refpurpose>DNSSEC zone signing tool</refpurpose>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </refnamediv>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <docinfo>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <copyright>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2004</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2005</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2006</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2007</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2008</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2009</year>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <year>2011</year>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <year>2012</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2013</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </copyright>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <copyright>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2000</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2001</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2002</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <year>2003</year>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <holder>Internet Software Consortium.</holder>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </copyright>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt </docinfo>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refsynopsisdiv>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <cmdsynopsis>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>dnssec-signzone</command>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-a</option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-d <replaceable class="parameter">directory</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-D</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-e <replaceable class="parameter">end-time</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-f <replaceable class="parameter">output-file</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-g</option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-h</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-k <replaceable class="parameter">key</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-L <replaceable class="parameter">serial</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-j <replaceable class="parameter">jitter</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-N <replaceable class="parameter">soa-serial-format</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <arg><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-P</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-p</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-R</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-S</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-t</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-u</option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <arg><option>-X <replaceable class="parameter">extended end-time</replaceable></option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-x</option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-z</option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-3 <replaceable class="parameter">salt</replaceable></option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-H <replaceable class="parameter">iterations</replaceable></option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg><option>-A</option></arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg choice="req">zonefile</arg>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <arg rep="repeat">key</arg>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </cmdsynopsis>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </refsynopsisdiv>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refsect1>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <title>DESCRIPTION</title>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para><command>dnssec-signzone</command>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt signs a zone. It generates

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt NSEC and RRSIG records and produces a signed version of the

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt zone. The security status of delegations from the signed zone

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt (that is, whether the child zones are secure or not) is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt determined by the presence or absence of a

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <filename>keyset</filename> file for each child zone.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </refsect1>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <refsect1>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <title>OPTIONS</title>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <variablelist>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-a</term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Verify all generated signatures.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-c <replaceable class="parameter">class</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Specifies the DNS class of the zone.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-C</term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Compatibility mode: Generate a

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <filename>keyset-<replaceable>zonename</replaceable></filename>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt file in addition to

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <filename>dsset-<replaceable>zonename</replaceable></filename>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt when signing a zone, for use by older versions of

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>dnssec-signzone</command>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-d <replaceable class="parameter">directory</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Look for <filename>dsset-</filename> or

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <filename>keyset-</filename> files in <option>directory</option>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-D</term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Output only those record types automatically managed by

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>dnssec-signzone</command>, i.e. RRSIG, NSEC,

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt NSEC3 and NSEC3PARAM records. If smart signing

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt (<option>-S</option>) is used, DNSKEY records are also

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt included. The resulting file can be included in the original

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt zone file with <command>$INCLUDE</command>. This option

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt cannot be combined with <option>-O raw</option>,

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <option>-O map</option>, or serial number updating.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-E <replaceable class="parameter">engine</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt When applicable, specifies the hardware to use for

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt cryptographic operations, such as a secure key store used

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt for signing.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt When BIND is built with OpenSSL PKCS#11 support, this defaults

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt to the string "pkcs11", which identifies an OpenSSL engine

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt that can drive a cryptographic accelerator or hardware service

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt module. When BIND is built with native PKCS#11 cryptography

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt (--enable-native-pkcs11), it defaults to the path of the PKCS#11

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt provider library specified via "--with-pkcs11".

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-g</term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Generate DS records for child zones from

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <filename>dsset-</filename> or <filename>keyset-</filename>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt file. Existing DS records will be removed.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-K <replaceable class="parameter">directory</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Key repository: Specify a directory to search for DNSSEC keys.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt If not specified, defaults to the current directory.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-k <replaceable class="parameter">key</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Treat specified key as a key signing key ignoring any

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt key flags. This option may be specified multiple times.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-l <replaceable class="parameter">domain</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Generate a DLV set in addition to the key (DNSKEY) and DS sets.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The domain is appended to the name of the records.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-s <replaceable class="parameter">start-time</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Specify the date and time when the generated RRSIG records

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt become valid. This can be either an absolute or relative

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt time. An absolute start time is indicated by a number

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt in YYYYMMDDHHMMSS notation; 20000530144500 denotes

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt 14:45:00 UTC on May 30th, 2000. A relative start time is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt indicated by +N, which is N seconds from the current time.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt If no <option>start-time</option> is specified, the current

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt time minus 1 hour (to allow for clock skew) is used.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-e <replaceable class="parameter">end-time</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Specify the date and time when the generated RRSIG records

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt expire. As with <option>start-time</option>, an absolute

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt time is indicated in YYYYMMDDHHMMSS notation. A time relative

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt to the start time is indicated with +N, which is N seconds from

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt the start time. A time relative to the current time is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt indicated with now+N. If no <option>end-time</option> is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt specified, 30 days from the start time is used as a default.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <option>end-time</option> must be later than

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <option>start-time</option>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-X <replaceable class="parameter">extended end-time</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Specify the date and time when the generated RRSIG records

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt for the DNSKEY RRset will expire. This is to be used in cases

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt when the DNSKEY signatures need to persist longer than

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt signatures on other records; e.g., when the private component

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt of the KSK is kept offline and the KSK signature is to be

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt refreshed manually.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt As with <option>start-time</option>, an absolute

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt time is indicated in YYYYMMDDHHMMSS notation. A time relative

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt to the start time is indicated with +N, which is N seconds from

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt the start time. A time relative to the current time is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt indicated with now+N. If no <option>extended end-time</option> is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt specified, the value of <option>end-time</option> is used as

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt the default. (<option>end-time</option>, in turn, defaults to

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt 30 days from the start time.) <option>extended end-time</option>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt must be later than <option>start-time</option>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-f <replaceable class="parameter">output-file</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The name of the output file containing the signed zone. The

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt default is to append <filename>.signed</filename> to

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt the input filename. If <option>output-file</option> is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt set to <literal>"-"</literal>, then the signed zone is

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt written to the standard output, with a default output

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt format of "full".

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-h</term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Prints a short summary of the options and arguments to

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>dnssec-signzone</command>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-i <replaceable class="parameter">interval</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt When a previously-signed zone is passed as input, records

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt may be resigned. The <option>interval</option> option

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt specifies the cycle interval as an offset from the current

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt time (in seconds). If a RRSIG record expires after the

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt cycle interval, it is retained. Otherwise, it is considered

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt to be expiring soon, and it will be replaced.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The default cycle interval is one quarter of the difference

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt between the signature end and start times. So if neither

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <option>end-time</option> or <option>start-time</option>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt are specified, <command>dnssec-signzone</command>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt generates

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt signatures that are valid for 30 days, with a cycle

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt interval of 7.5 days. Therefore, if any existing RRSIG records

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt are due to expire in less than 7.5 days, they would be

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt replaced.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-I <replaceable class="parameter">input-format</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The format of the input zone file.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Possible formats are <command>"text"</command> (default),

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>"raw"</command>, and <command>"map"</command>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt This option is primarily intended to be used for dynamic

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt signed zones so that the dumped zone file in a non-text

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt format containing updates can be signed directly.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The use of this option does not make much sense for

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt non-dynamic zones.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-j <replaceable class="parameter">jitter</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt When signing a zone with a fixed signature lifetime, all

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt RRSIG records issued at the time of signing expires

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt simultaneously. If the zone is incrementally signed, i.e.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt a previously-signed zone is passed as input to the signer,

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt all expired signatures have to be regenerated at about the

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt same time. The <option>jitter</option> option specifies a

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt jitter window that will be used to randomize the signature

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt expire time, thus spreading incremental signature

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt regeneration over time.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Signature lifetime jitter also to some extent benefits

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt validators and servers by spreading out cache expiration,

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt i.e. if large numbers of RRSIGs don't expire at the same time

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt from all caches there will be less congestion than if all

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt validators need to refetch at mostly the same time.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-L <replaceable class="parameter">serial</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt When writing a signed zone to "raw" or "map" format, set the

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt "source serial" value in the header to the specified serial

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt number. (This is expected to be used primarily for testing

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt purposes.)

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-n <replaceable class="parameter">ncpus</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Specifies the number of threads to use. By default, one

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt thread is started for each detected CPU.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-N <replaceable class="parameter">soa-serial-format</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The SOA serial number format of the signed zone.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Possible formats are <command>"keep"</command> (default),

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>"increment"</command> and

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>"unixtime"</command>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <variablelist>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term><command>"keep"</command></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>Do not modify the SOA serial number.</para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <term><command>"increment"</command></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>Increment the SOA serial number using RFC 1982

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt arithmetics.</para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term><command>"unixtime"</command></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

0b24b2d3c423560a0a4cd9a4476b9a2dcafb7ea3Evan Hunt <para>Set the SOA serial number to the number of seconds

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt since epoch.</para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </variablelist>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-o <replaceable class="parameter">origin</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The zone origin. If not specified, the name of the zone file

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt is assumed to be the origin.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-O <replaceable class="parameter">output-format</replaceable></term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The format of the output file containing the signed zone.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Possible formats are <command>"text"</command> (default),

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt which is the standard textual representation of the zone;

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>"full"</command>, which is text output in a

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt format suitable for processing by external scripts;

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt and <command>"map"</command>, <command>"raw"</command>,

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt and <command>"raw=N"</command>, which store the zone in

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt binary formats for rapid loading by <command>named</command>.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <command>"raw=N"</command> specifies the format version of

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt the raw zone file: if N is 0, the raw file can be read by

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt any version of <command>named</command>; if N is 1, the file

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt can be read by release 9.9.0 or higher; the default is 1.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-p</term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Use pseudo-random data when signing the zone. This is faster,

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt but less secure, than using real random data. This option

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt may be useful when signing large zones or when the entropy

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt source is limited.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-P</term>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Disable post sign verification tests.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt The post sign verification test ensures that for each algorithm

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt in use there is at least one non revoked self signed KSK key,

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt that all revoked KSK keys are self signed, and that all records

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt in the zone are signed by the algorithm.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt This option skips these tests.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <varlistentry>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <term>-Q</term>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt <listitem>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Remove signatures from keys that are no longer active.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt </para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt <para>

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt Normally, when a previously-signed zone is passed as input

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt to the signer, and a DNSKEY record has been removed and

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt replaced with a new one, signatures from the old key

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt that are still within their validity period are retained.

01967d183990e44752fe61f193dab9c04c3afd9cEvan Hunt This allows the zone to continue to validate with cached

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt copies of the old DNSKEY RRset. The <option>-Q</option>

14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt forces <command>dnssec-signzone</command> to remove

signatures from keys that are no longer active. This

enables ZSK rollover using the procedure described in

RFC 4641, section 4.2.1.1 ("Pre-Publish Key Rollover").

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-R</term>

<listitem>

<para>

Remove signatures from keys that are no longer published.

</para>

<para>

This option is similar to <option>-Q</option>, except it

forces <command>dnssec-signzone</command> to signatures from

keys that are no longer published. This enables ZSK rollover

using the procedure described in RFC 4641, section 4.2.1.2

("Double Signature Zone Signing Key Rollover").

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-r <replaceable class="parameter">randomdev</replaceable></term>

<listitem>

<para>

Specifies the source of randomness. If the operating

system does not provide a <filename>/dev/random</filename>

or equivalent device, the default source of randomness

is keyboard input. <filename>randomdev</filename>

specifies

the name of a character device or file containing random

data to be used instead of the default. The special value

<filename>keyboard</filename> indicates that keyboard

input should be used.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-S</term>

<listitem>

<para>

Smart signing: Instructs <command>dnssec-signzone</command> to

search the key repository for keys that match the zone being

signed, and to include them in the zone if appropriate.

</para>

<para>

When a key is found, its timing metadata is examined to

determine how it should be used, according to the following

rules. Each successive rule takes priority over the prior

ones:

</para>

<variablelist>

<varlistentry>

<listitem>

<para>

If no timing metadata has been set for the key, the key is

published in the zone and used to sign the zone.

</para>

</listitem>

</varlistentry>

<varlistentry>

<listitem>

<para>

If the key's publication date is set and is in the past, the

key is published in the zone.

</para>

</listitem>

</varlistentry>

<varlistentry>

<listitem>

<para>

If the key's activation date is set and in the past, the

key is published (regardless of publication date) and

used to sign the zone.

</para>

</listitem>

</varlistentry>

<varlistentry>

<listitem>

<para>

If the key's revocation date is set and in the past, and the

key is published, then the key is revoked, and the revoked key

is used to sign the zone.

</para>

</listitem>

</varlistentry>

<varlistentry>

<listitem>

<para>

If either of the key's unpublication or deletion dates are set

and in the past, the key is NOT published or used to sign the

zone, regardless of any other metadata.

</para>

</listitem>

</varlistentry>

</variablelist>

</listitem>

</varlistentry>

<varlistentry>

<term>-T <replaceable class="parameter">ttl</replaceable></term>

<listitem>

<para>

Specifies a TTL to be used for new DNSKEY records imported

into the zone from the key repository. If not

specified, the default is the TTL value from the zone's SOA

record. This option is ignored when signing without

<option>-S</option>, since DNSKEY records are not imported

from the key repository in that case. It is also ignored if

there are any pre-existing DNSKEY records at the zone apex,

in which case new records' TTL values will be set to match

them, or if any of the imported DNSKEY records had a default

TTL value. In the event of a a conflict between TTL values in

imported keys, the shortest one is used.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-t</term>

<listitem>

<para>

Print statistics at completion.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-u</term>

<listitem>

<para>

Update NSEC/NSEC3 chain when re-signing a previously signed

zone. With this option, a zone signed with NSEC can be

switched to NSEC3, or a zone signed with NSEC3 can

be switch to NSEC or to NSEC3 with different parameters.

Without this option, <command>dnssec-signzone</command> will

retain the existing chain when re-signing.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-v <replaceable class="parameter">level</replaceable></term>

<listitem>

<para>

Sets the debugging level.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-x</term>

<listitem>

<para>

Only sign the DNSKEY RRset with key-signing keys, and omit

signatures from zone-signing keys. (This is similar to the

<command>dnssec-dnskey-kskonly yes;</command> zone option in

<command>named</command>.)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-z</term>

<listitem>

<para>

Ignore KSK flag on key when determining what to sign. This

causes KSK-flagged keys to sign all records, not just the

DNSKEY RRset. (This is similar to the

<command>update-check-ksk no;</command> zone option in

<command>named</command>.)

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-3 <replaceable class="parameter">salt</replaceable></term>

<listitem>

<para>

Generate an NSEC3 chain with the given hex encoded salt.

A dash (<replaceable class="parameter">salt</replaceable>) can

be used to indicate that no salt is to be used when generating the NSEC3 chain.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-H <replaceable class="parameter">iterations</replaceable></term>

<listitem>

<para>

When generating an NSEC3 chain, use this many iterations. The

default is 10.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>-A</term>

<listitem>

<para>

When generating an NSEC3 chain set the OPTOUT flag on all

NSEC3 records and do not generate NSEC3 records for insecure

delegations.

</para>

<para>

Using this option twice (i.e., <option>-AA</option>)

turns the OPTOUT flag off for all records. This is useful

when using the <option>-u</option> option to modify an NSEC3

chain which previously had OPTOUT set.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>zonefile</term>

<listitem>

<para>

The file containing the zone to be signed.

</para>

</listitem>

</varlistentry>

<varlistentry>

<term>key</term>

<listitem>

<para>

Specify which keys should be used to sign the zone. If

no keys are specified, then the zone will be examined

for DNSKEY records at the zone apex. If these are found and

there are matching private keys, in the current directory,

then these will be used for signing.

</para>

</listitem>

</varlistentry>

</variablelist>

</refsect1>

<refsect1>

<title>EXAMPLE</title>

<para>

The following command signs the <userinput>example.com</userinput>

zone with the DSA key generated by <command>dnssec-keygen</command>

(Kexample.com.+003+17247). Because the <command>-S</command> option

is not being used, the zone's keys must be in the master file

(<filename>db.example.com</filename>). This invocation looks

for <filename>dsset</filename> files, in the current directory,

so that DS records can be imported from them (<command>-g</command>).

</para>

<programlisting>% dnssec-signzone -g -o example.com db.example.com \

Kexample.com.+003+17247

%</programlisting>

<para>

In the above example, <command>dnssec-signzone</command> creates

the file <filename>db.example.com.signed</filename>. This

file should be referenced in a zone statement in a

<filename>named.conf</filename> file.

</para>

<para>

This example re-signs a previously signed zone with default parameters.

The private keys are assumed to be in the current directory.

</para>

<programlisting>% cp db.example.com.signed db.example.com

% dnssec-signzone -o example.com db.example.com

%</programlisting>

</refsect1>

<refsect1>

<title>SEE ALSO</title>

<para><citerefentry>

<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>

</citerefentry>,

<citetitle>BIND 9 Administrator Reference Manual</citetitle>,

<citetitle>RFC 4033</citetitle>, <citetitle>RFC 4641</citetitle>.

</para>

</refsect1>

<refsect1>

<title>AUTHOR</title>

<para><corpauthor>Internet Systems Consortium</corpauthor>

</para>

</refsect1>

</refentry><!--