man.dnssec-dsfromkey.html revision cd32f419a8a5432fbb139f56ee73cbf68b9350cc
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence - Copyright (C) 2000-2003 Internet Software Consortium.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - Permission to use, copy, modify, and/or distribute this software for any
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - purpose with or without fee is hereby granted, provided that the above
1633838b8255282d10af15c5c84cee5a51466712Bob Halley - copyright notice and this permission notice appear in all copies.
c50fd34a4e0e6978f8ca5f6f3ad8545549c3cfeeBob Halley - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
c50fd34a4e0e6978f8ca5f6f3ad8545549c3cfeeBob Halley - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
c50fd34a4e0e6978f8ca5f6f3ad8545549c3cfeeBob Halley - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
29747dfe5e073a299b3681e01f5c55540f8bfed7Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
e4e071ae12aee942fefc2c0a3280e402938669deBob Halley - PERFORMANCE OF THIS SOFTWARE.
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley<!-- $Id$ -->
09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley<link rel="next" href="man.dnssec-importkey.html" title="dnssec-importkey">
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<table width="100%" summary="Navigation header">
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
b6309ed962c4988a314d61742c4fbc4935467d68Mark Andrews<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
b6309ed962c4988a314d61742c4fbc4935467d68Mark Andrews<th width="60%" align="center">Manual pages</th>
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
84cb41f729e2a8526300dd7a6cffaa66da5cf6cdMark Andrews<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<a name="id2620050"></a><h2>DESCRIPTION</h2>
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington<p><span><strong class="command">dnssec-dsfromkey</strong></span>
618e871c2eb80021673bedf083496ccd1bf65cd0Brian Wellington outputs the Delegation Signer (DS) resource record (RR), as defined in
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington RFC 3658 and RFC 4509, for the given key(s).
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington Use SHA-1 as the digest algorithm (the default is to use
125d72976ab6b8fa6629a5ace276a86e9fef91acBrian Wellington both SHA-1 and SHA-256).
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley Use SHA-256 as the digest algorithm.
04b8111f2137a9cf9b0b71228f76b3e40ffa1173Brian Wellington<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
ccad3c9ecbe8a1060ff7b407a318ccd592de536eBrian Wellington Select the digest algorithm. The value of
ccad3c9ecbe8a1060ff7b407a318ccd592de536eBrian Wellington <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
ccad3c9ecbe8a1060ff7b407a318ccd592de536eBrian Wellington SHA-256 (SHA256), GOST or SHA-384 (SHA384).
ccad3c9ecbe8a1060ff7b407a318ccd592de536eBrian Wellington These values are case insensitive.
8224be5129daebea8f0f5e8be5f925679ec893f1Brian Wellington<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
a413f94248ceed48a6b7aaa2fa1d2401fb8b9f30Brian Wellington Specifies the TTL of the DS records.
63d1ef9e771b748ca9bf241dfc1f07d3730203faBob Halley<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
cd02757774252fe5b92dbd59a24b34721fb49ff4Bob Halley Look for key files (or, in keyset mode,
322b0fb39dd1538c9f5021cd2f54d4c12684ecdbBrian Wellington<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
afbc02482008c58af2c98000209165f6880835f7Mark Andrews Zone file mode: in place of the keyfile name, the argument is
e1f16346db02486f751c6db683fffe53c866c186Andreas Gustafsson the DNS domain name of a zone master file, which can be read
93d6dfaf66258337985427c86181f01fc51f0bb4Mark Andrews from <code class="option">file</code>. If the zone name is the same as
2ee24549b3dddd4046ee14257e1207cf2e34f29cBrian Wellington <code class="option">file</code>, then it may be omitted.
20a313a4581e7f85fb2ce37430a146b3538da841Mark Andrews If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
20a313a4581e7f85fb2ce37430a146b3538da841Mark Andrews the zone data is read from the standard input. This makes it
b20ee662a7c847c9ef7b96ab9e5e34543efe5c0dMark Andrews possible to use the output of the <span><strong class="command">dig</strong></span>
b55c30f2de6e1baaa3a9ba69b92f428f2c255ac3Mark Andrews command as input, as in:
1275a72e8db349ce249c84804b2b4861d33d4db7Brian Wellington <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
9ac7076ebad044afb15e9e2687e3696868778538Mark Andrews Include ZSKs when generating DS records. Without this option,
5ea0d11ca45bfd1ea9db8db07f18fbb02f500661Brian Wellington only keys which have the KSK flag set will be converted to DS
a9ef4854464fcc56d95f72331b6e09e9563bb5f3Andreas Gustafsson records and printed. Useful only in zone file mode.
01446841be2b73f9a2ead74056df2d5342414041Andreas Gustafsson<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
b6279d0b4b19f041b29775e637074e09f38e5e11Brian Wellington Generate a DLV set instead of a DS set. The specified
231ffa6c85cd04d5d83f80643e26fdc3ff510138Brian Wellington <code class="option">domain</code> is appended to the name for each
4b171ebd702d72200a4d7609f11c5f79d6b6f964Brian Wellington record in the set.
0b09763c354ec91fb352b6b4cea383bd0195b2d8Mark Andrews The DNSSEC Lookaside Validation (DLV) RR is described
4d9f3f00d93fcb8743b1105e8cf82e862be220d1Mark Andrews in RFC 4431.
5bd76af084edfdcd1cb4db9453ac781d32dde6f7Mark Andrews Keyset mode: in place of the keyfile name, the argument is
5bd76af084edfdcd1cb4db9453ac781d32dde6f7Mark Andrews the DNS domain name of a keyset file.
421e4cf66e4cba0b0751a34a9c027e39fe0474f9Mark Andrews<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
182a34004c7c48e2c1626f3ce7e787f413955126Mark Andrews Specifies the DNS class (default is IN). Useful only
35541328a8c18ba1f984300dfe30ec8713c90031Mark Andrews in keyset or zone file mode.
2047977ce2dfcfe3a0fa2d638c3242841310fad3Mark Andrews<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
c5cde9d5a70c921da901a23845e740ccc7a8c4e4Mark Andrews Sets the debugging level.
9b80f3a7c739a99b498a37a711a51b6a88df3a78Mark Andrews Prints usage information.
433e06a25cdd92d665abda3e64c2c65f4a3f9b21Mark Andrews Prints version information.
b66b333f59cf51ef87f973084a5023acd9317fb2Evan Hunt To build the SHA-256 DS RR from the
8475bed9de77920f884f1ae296f581efbd1e42f8Mark Andrews <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
8475bed9de77920f884f1ae296f581efbd1e42f8Mark Andrews keyfile name, the following command would be issued:
8475bed9de77920f884f1ae296f581efbd1e42f8Mark Andrews<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
894a2f61c9e3e51463bf21957c003d7c5636bdc5David Lawrence The command would print something like:
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley The keyfile can be designed by the key identification
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley <span class="refentrytitle">dnssec-keygen</span>(8).
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley The keyset file name is built from the <code class="option">directory</code>,
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley the string <code class="filename">keyset-</code> and the
25e43e68b7431d5e4ff8b5427108cd7f5f9bcf3eBob Halley A keyfile error can give a "file not found" even if the file exists.
c50fd34a4e0e6978f8ca5f6f3ad8545549c3cfeeBob Halley<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
09f22ac5b09e70bc526015f37168ba33e21ea91fDavid Lawrence<p><span class="corpauthor">Internet Systems Consortium</span>