dnssec-signzone.html revision 3f9791eac42b243d9f328d604e117f91a3f67a37
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - Copyright (C) 2004-2009, 2011-2013 Internet Systems Consortium, Inc. ("ISC")
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - Copyright (C) 2000-2003 Internet Software Consortium.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - Permission to use, copy, modify, and/or distribute this software for any
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - purpose with or without fee is hereby granted, provided that the above
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - copyright notice and this permission notice appear in all copies.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe - PERFORMANCE OF THIS SOFTWARE.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<!-- $Id$ -->
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<p><span><strong class="command">dnssec-signzone</strong></span>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe signs a zone. It generates
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe NSEC and RRSIG records and produces a signed version of the
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe zone. The security status of delegations from the signed zone
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe (that is, whether the child zones are secure or not) is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe determined by the presence or absence of a
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="filename">keyset</code> file for each child zone.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Verify all generated signatures.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Specifies the DNS class of the zone.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Compatibility mode: Generate a
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe file in addition to
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe when signing a zone, for use by older versions of
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <span><strong class="command">dnssec-signzone</strong></span>.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Look for <code class="filename">dsset-</code> or
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="filename">keyset-</code> files in <code class="option">directory</code>.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Output only those record types automatically managed by
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <span><strong class="command">dnssec-signzone</strong></span>, i.e. RRSIG, NSEC,
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe NSEC3 and NSEC3PARAM records. If smart signing
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe (<code class="option">-S</code>) is used, DNSKEY records are also
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe included. The resulting file can be included in the original
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe zone file with <span><strong class="command">$INCLUDE</strong></span>. This option
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe cannot be combined with <code class="option">-O raw</code>,
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="option">-O map</code>, or serial number updating.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Uses a crypto hardware (OpenSSL engine) for the crypto operations
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe it supports, for instance signing with private keys from
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe a secure key store. When compiled with PKCS#11 support
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe it defaults to pkcs11; the empty name resets it to no engine.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Generate DS records for child zones from
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="filename">dsset-</code> or <code class="filename">keyset-</code>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe file. Existing DS records will be removed.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Key repository: Specify a directory to search for DNSSEC keys.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe If not specified, defaults to the current directory.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Treat specified key as a key signing key ignoring any
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe key flags. This option may be specified multiple times.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Generate a DLV set in addition to the key (DNSKEY) and DS sets.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe The domain is appended to the name of the records.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Specify the date and time when the generated RRSIG records
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe become valid. This can be either an absolute or relative
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe time. An absolute start time is indicated by a number
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe in YYYYMMDDHHMMSS notation; 20000530144500 denotes
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe 14:45:00 UTC on May 30th, 2000. A relative start time is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe indicated by +N, which is N seconds from the current time.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe If no <code class="option">start-time</code> is specified, the current
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe time minus 1 hour (to allow for clock skew) is used.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Specify the date and time when the generated RRSIG records
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe expire. As with <code class="option">start-time</code>, an absolute
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe time is indicated in YYYYMMDDHHMMSS notation. A time relative
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe to the start time is indicated with +N, which is N seconds from
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe the start time. A time relative to the current time is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe indicated with now+N. If no <code class="option">end-time</code> is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe specified, 30 days from the start time is used as a default.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="option">end-time</code> must be later than
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Specify the date and time when the generated RRSIG records
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe for the DNSKEY RRset will expire. This is to be used in cases
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe when the DNSKEY signatures need to persist longer than
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe signatures on other records; e.g., when the private component
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe of the KSK is kept offline and the KSK signature is to be
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe refreshed manually.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe As with <code class="option">start-time</code>, an absolute
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe time is indicated in YYYYMMDDHHMMSS notation. A time relative
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe to the start time is indicated with +N, which is N seconds from
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe the start time. A time relative to the current time is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe indicated with now+N. If no <code class="option">extended end-time</code> is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe specified, the value of <code class="option">end-time</code> is used as
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe the default. (<code class="option">end-time</code>, in turn, defaults to
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe 30 days from the start time.) <code class="option">extended end-time</code>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe must be later than <code class="option">start-time</code>.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe The name of the output file containing the signed zone. The
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe default is to append <code class="filename">.signed</code> to
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe the input filename. If <code class="option">output-file</code> is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe set to <code class="literal">"-"</code>, then the signed zone is
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe written to the standard output, with a default output
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe format of "full".
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Prints a short summary of the options and arguments to
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <span><strong class="command">dnssec-signzone</strong></span>.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe When a previously-signed zone is passed as input, records
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe may be resigned. The <code class="option">interval</code> option
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe specifies the cycle interval as an offset from the current
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe time (in seconds). If a RRSIG record expires after the
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe cycle interval, it is retained. Otherwise, it is considered
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe to be expiring soon, and it will be replaced.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe The default cycle interval is one quarter of the difference
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe between the signature end and start times. So if neither
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <code class="option">end-time</code> or <code class="option">start-time</code>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe are specified, <span><strong class="command">dnssec-signzone</strong></span>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe signatures that are valid for 30 days, with a cycle
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe interval of 7.5 days. Therefore, if any existing RRSIG records
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe are due to expire in less than 7.5 days, they would be
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe The format of the input zone file.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Possible formats are <span><strong class="command">"text"</strong></span> (default),
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe <span><strong class="command">"raw"</strong></span>, and <span><strong class="command">"map"</strong></span>.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe This option is primarily intended to be used for dynamic
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe signed zones so that the dumped zone file in a non-text
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe format containing updates can be signed directly.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe The use of this option does not make much sense for
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe non-dynamic zones.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe When signing a zone with a fixed signature lifetime, all
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe RRSIG records issued at the time of signing expires
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe simultaneously. If the zone is incrementally signed, i.e.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe a previously-signed zone is passed as input to the signer,
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe all expired signatures have to be regenerated at about the
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe same time. The <code class="option">jitter</code> option specifies a
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe jitter window that will be used to randomize the signature
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe expire time, thus spreading incremental signature
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe regeneration over time.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Signature lifetime jitter also to some extent benefits
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe validators and servers by spreading out cache expiration,
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe i.e. if large numbers of RRSIGs don't expire at the same time
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe from all caches there will be less congestion than if all
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe validators need to refetch at mostly the same time.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe When writing a signed zone to "raw" or "map" format, set the
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe "source serial" value in the header to the specified serial
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe number. (This is expected to be used primarily for testing
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe Specifies the number of threads to use. By default, one
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe thread is started for each detected CPU.
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
c10c16dec587a0662068f6e2991c29ed3a9db943Richard Lowe The SOA serial number format of the signed zone.
and <span><strong class="command">"map"</strong></span>, <span><strong class="command">"raw"</strong></span>,
Kexample.com.+003+17247