dnssec-signzone.html revision 89da2a56413ba6294315bdde04f7547b9d71b062
65ad89971ee9973074cd11c207af92bf5440df01Automatic Updater - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - Copyright (C) 2001-2003 Internet Software Consortium.
689023771c563d8660e45d439a207e06e96de28fMark Andrews - Permission to use, copy, modify, and distribute this software for any
689023771c563d8660e45d439a207e06e96de28fMark Andrews - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
689023771c563d8660e45d439a207e06e96de28fMark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
689023771c563d8660e45d439a207e06e96de28fMark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
689023771c563d8660e45d439a207e06e96de28fMark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
689023771c563d8660e45d439a207e06e96de28fMark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
689023771c563d8660e45d439a207e06e96de28fMark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
689023771c563d8660e45d439a207e06e96de28fMark Andrews - PERFORMANCE OF THIS SOFTWARE.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!-- $Id: dnssec-signzone.html,v 1.16 2005/04/03 03:31:32 marka Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
4abdfc917e6635a7c81d1f931a0c79227e72d025Mark Andrews>dnssec-signzone</TITLE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="GENERATOR"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCONTENT="Modular DocBook HTML Stylesheet Version 1.79"></HEAD
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REFENTRY"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinBGCOLOR="#FFFFFF"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinTEXT="#000000"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinLINK="#0000FF"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinVLINK="#840084"
65ad89971ee9973074cd11c207af92bf5440df01Automatic UpdaterALINK="#0000FF"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="APPLICATION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-signzone</SPAN
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REFNAMEDIV"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="APPLICATION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-signzone</SPAN
65ad89971ee9973074cd11c207af92bf5440df01Automatic Updater> -- DNSSEC zone signing tool</DIV
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REFSYNOPSISDIV"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="COMMAND"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-signzone</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>directory</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>output-file</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
d060d8669f5558690e7faf4a1c12fe5c02a7c60dAutomatic UpdaterCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>randomdev</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>start-time</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>] {zonefile} [key...]</P
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REFSECT1"
517ae3de96aaf870049c52f1224e38a85fe7f21aAutomatic Updater>DESCRIPTION</H2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="COMMAND"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-signzone</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> signs a zone. It generates
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein NSEC and RRSIG records and produces a signed version of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone. The security status of delegations from the signed zone
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews (that is, whether the child zones are secure or not) is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determined by the presence or absence of a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="FILENAME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> file for each child zone.
689023771c563d8660e45d439a207e06e96de28fMark AndrewsCLASS="REFSECT1"
89bc48260b64a8859ae717e9e5bae380e275fef4Mark AndrewsCLASS="VARIABLELIST"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Verify all generated signatures.
538a83db7509d598da95a93bd7b74ef3112123a4Mark AndrewsCLASS="REPLACEABLE"
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews> Specifies the DNS class of the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Treat specified key as a key signing key ignoring any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein key flags. This option may be specified multiple times.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark AndrewsCLASS="REPLACEABLE"
65ad89971ee9973074cd11c207af92bf5440df01Automatic Updater> Generate a DLV set in addition to the key (DNSKEY) and DS sets.
65ad89971ee9973074cd11c207af92bf5440df01Automatic Updater The domain is appended to the name of the records.
1586d8cbac5d73031716561386f60758c6c332d5Mark AndrewsCLASS="REPLACEABLE"
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews>directory</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Look for <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="FILENAME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>directory</CODE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> as the directory
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Generate DS records for child zones from keyset files.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Existing DS records will be removed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>start-time</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein become valid. This can be either an absolute or relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time. An absolute start time is indicated by a number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in YYYYMMDDHHMMSS notation; 20000530144500 denotes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 14:45:00 UTC on May 30th, 2000. A relative start time is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein indicated by +N, which is N seconds from the current time.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>start-time</CODE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> is specified, the current
aeb7938001b22e811a910e1b36cdf452f9193865Automatic Updater time minus 1 hour (to allow for clock skew) is used.
aeb7938001b22e811a910e1b36cdf452f9193865Automatic UpdaterCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Specify the date and time when the generated RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire. As with <CODE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>start-time</CODE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>, an absolute
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to the start time is indicated with +N, which is N seconds from
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the start time. A time relative to the current time is
0284e57b9b9dfaf2517a2cc3282ecf766b8ad075Automatic Updater indicated with now+N. If no <CODE
6bf6622b7b9053dc52527478473b572f042c4b5bMark Andrews>end-time</CODE
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews specified, 30 days from the start time is used as a default.
d060d8669f5558690e7faf4a1c12fe5c02a7c60dAutomatic UpdaterCLASS="REPLACEABLE"
d060d8669f5558690e7faf4a1c12fe5c02a7c60dAutomatic Updater>output-file</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> The name of the output file containing the signed zone. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default is to append <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="FILENAME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Prints a short summary of the options and arguments to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="COMMAND"
d9c707589ade5d69fb59b6837555adc4cd24d34fAutomatic Updater>dnssec-signzone</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
689023771c563d8660e45d439a207e06e96de28fMark Andrews> When a previously signed zone is passed as input, records
689023771c563d8660e45d439a207e06e96de28fMark Andrews may be resigned. The <CODE
4f6469885c3d66367e3f8fb94e1f3c66115990b0Mark AndrewsCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>interval</CODE
689023771c563d8660e45d439a207e06e96de28fMark Andrews specifies the cycle interval as an offset from the current
4f6469885c3d66367e3f8fb94e1f3c66115990b0Mark Andrews time (in seconds). If a RRSIG record expires after the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cycle interval, it is retained. Otherwise, it is considered
d060d8669f5558690e7faf4a1c12fe5c02a7c60dAutomatic Updater to be expiring soon, and it will be replaced.
4f6469885c3d66367e3f8fb94e1f3c66115990b0Mark Andrews> The default cycle interval is one quarter of the difference
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein between the signature end and start times. So if neither
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>end-time</CODE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="OPTION"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>start-time</CODE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are specified, <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="COMMAND"
689023771c563d8660e45d439a207e06e96de28fMark Andrews>dnssec-signzone</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein signatures that are valid for 30 days, with a cycle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein interval of 7.5 days. Therefore, if any existing RRSIG records
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein are due to expire in less than 7.5 days, they would be
79cf9524b15ca65f55fd6913e6cf01b5581c588aAutomatic Updater> When signing a zone with a fixed signature lifetime, all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein RRSIG records issued at the time of signing expires
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein simultaneously. If the zone is incrementally signed, i.e.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a previously signed zone is passed as input to the signer,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein all expired signatures has to be regenerated at about the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein same time. The <CODE
276e28f813ffef042d5a6e9f3373ef4e2ad37996Mark AndrewsCLASS="OPTION"
276e28f813ffef042d5a6e9f3373ef4e2ad37996Mark Andrews>jitter</CODE
538a83db7509d598da95a93bd7b74ef3112123a4Mark Andrews> option specifies a
538a83db7509d598da95a93bd7b74ef3112123a4Mark Andrews jitter window that will be used to randomize the signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein expire time, thus spreading incremental signature
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein regeneration over time.
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews> Signature lifetime jitter also to some extent benefits
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark Andrews validators and servers by spreading out cache expiration,
22c71c7b86fa57a19f7df0da4222eb8593e6ad12Mark Andrews i.e. if large numbers of RRSIGs don't expire at the same time
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein from all caches there will be less congestion than if all
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein validators need to refetch at mostly the same time.
689023771c563d8660e45d439a207e06e96de28fMark AndrewsCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Specifies the number of threads to use. By default, one
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein thread is started for each detected CPU.
65ad89971ee9973074cd11c207af92bf5440df01Automatic UpdaterCLASS="REPLACEABLE"
65ad89971ee9973074cd11c207af92bf5440df01Automatic Updater> The zone origin. If not specified, the name of the zone file
1586d8cbac5d73031716561386f60758c6c332d5Mark Andrews is assumed to be the origin.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Use pseudo-random data when signing the zone. This is faster,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein but less secure, than using real random data. This option
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein may be useful when signing large zones or when the entropy
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark Andrews source is limited.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Specifies the source of randomness. If the operating
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein system does not provide a <TT
7526edc7677371c366232de5f39a678b7dcda747Mark AndrewsCLASS="FILENAME"
d9c707589ade5d69fb59b6837555adc4cd24d34fAutomatic Updater or equivalent device, the default source of randomness
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein is keyboard input. <TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="FILENAME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>randomdev</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the name of a character device or file containing random
689023771c563d8660e45d439a207e06e96de28fMark Andrews data to be used instead of the default. The special value
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="FILENAME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>keyboard</TT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> indicates that keyboard
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein input should be used.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Print statistics at completion.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REPLACEABLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Sets the debugging level.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Ignore KSK flag on key when determining what to sign.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>zonefile</DT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> The file containing the zone to be signed.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the debugging level.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> The keys used to sign the zone. If no keys are specified, the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein default all zone keys that have private key files in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein current directory.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REFSECT1"
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark AndrewsNAME="AEN190"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> The following command signs the <KBD
3b4098640dd85040270f39b9a5ee5e22de99d3d6Mark AndrewsCLASS="USERINPUT"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zone with the DSA key generated in the <B
68b30890ebd441a6a1ae3fdf71744d07d02cd030Mark AndrewsCLASS="COMMAND"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-keygen</B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein man page. The zone's keys must be in the zone. If there are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="FILENAME"
f4429c1c31ec32f05125baab1adcc4f09863f7afMark Andrews> files associated with child zones,
d060d8669f5558690e7faf4a1c12fe5c02a7c60dAutomatic Updater they must be in the current directory.
d060d8669f5558690e7faf4a1c12fe5c02a7c60dAutomatic UpdaterCLASS="USERINPUT"
083a5588a3488b6335ee7bafa505d00644c7c58dMark Andrews>, the following command would be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="USERINPUT"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-signzone -o example.com db.example.com Kexample.com.+003+26160</KBD
d9c707589ade5d69fb59b6837555adc4cd24d34fAutomatic Updater> The command would print a string of the form:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> In this example, <B
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="COMMAND"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-signzone</B
689023771c563d8660e45d439a207e06e96de28fMark Andrews the file <TT
689023771c563d8660e45d439a207e06e96de28fMark AndrewsCLASS="FILENAME"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein should be referenced in a zone statement in a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="FILENAME"
eea6be913f9928255cab5f58ff27da41c1e8e23aAutomatic UpdaterCLASS="REFSECT1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="AEN204"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>SEE ALSO</H2
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="CITEREFENTRY"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REFENTRYTITLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>dnssec-keygen</SPAN
6bf6622b7b9053dc52527478473b572f042c4b5bMark AndrewsCLASS="CITETITLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein>BIND 9 Administrator Reference Manual</I
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="CITETITLE"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinCLASS="REFSECT1"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinNAME="AEN212"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein> Internet Systems Consortium