man.dnssec-dsfromkey.html revision 645a03d61e2fe1e4ec5695c95ec8d4343ac4920e
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
e6d40133bc9f858308654afb1262b8b483ec5922Till Mossakowski - Copyright (C) 2000-2003 Internet Software Consortium.
97018cf5fa25b494adffd7e9b4e87320dae6bf47Christian Maeder - Permission to use, copy, modify, and/or distribute this software for any
2eeec5240b424984e3ee26296da1eeab6c6d739eChristian Maeder - purpose with or without fee is hereby granted, provided that the above
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - copyright notice and this permission notice appear in all copies.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
e6d40133bc9f858308654afb1262b8b483ec5922Till Mossakowski - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
679d3f541f7a9ede4079e045f7758873bb901872Till Mossakowski - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
679d3f541f7a9ede4079e045f7758873bb901872Till Mossakowski - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
306763c67bb99228487345b32ab8c5c6cd41f23cChristian Maeder - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder - PERFORMANCE OF THIS SOFTWARE.
f69658e57cba7ecb37c0d84181f4c563215c2534Till Mossakowski<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
697e63e30aa3c309a1ef1f9357745111f8dfc5a9Christian Maeder<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
d420c2a27c4dfa0a9c8031449db2e1a89ad2cc3aChristian Maeder<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder<link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
697e63e30aa3c309a1ef1f9357745111f8dfc5a9Christian Maeder<link rel="next" href="man.dnssec-importkey.html" title="dnssec-importkey">
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e182d0ec56025d97d74829cac75ee31eec12b093Maciek Makowski<table width="100%" summary="Navigation header">
697e63e30aa3c309a1ef1f9357745111f8dfc5a9Christian Maeder<tr><th colspan="3" align="center"><span class="application">dnssec-dsfromkey</span></th></tr>
58b671de3fe578346fef9642ffa3c5a0a0edb3cbTill Mossakowski<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
56cd0da55d058b262b1626ddcd78db6bd9a90551Christian Maeder<th width="60%" align="center">Manual pages</th>
ba904a15082557e939db689fcfba0c68c9a4f740Christian Maeder<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maeder<a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
697e63e30aa3c309a1ef1f9357745111f8dfc5a9Christian Maeder<p><span class="application">dnssec-dsfromkey</span> — DNSSEC DS RR generation tool</p>
697e63e30aa3c309a1ef1f9357745111f8dfc5a9Christian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
7f7460e7095628f3437b116ee78d3043d11f8febChristian Maeder<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
c4040537e6f2153af475dd8b07260a1ee9a56ac0Christian Maeder<a name="id2620007"></a><h2>DESCRIPTION</h2>
b0294d73dcefc502ddaa13e18b46103a5916971fTill Mossakowski<p><span><strong class="command">dnssec-dsfromkey</strong></span>
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder outputs the Delegation Signer (DS) resource record (RR), as defined in
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder RFC 3658 and RFC 4509, for the given key(s).
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski Use SHA-1 as the digest algorithm (the default is to use
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder both SHA-1 and SHA-256).
2604ffeb18ba727a1c9a683f86629c4ce01b06acChristian Maeder Use SHA-256 as the digest algorithm.
4fc3dccf009f8ad9522960e54ab7a5c3d601e342Klaus Luettich<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
1e3950d5c1f0e041dd7677856e43f07796567d5bChristian Maeder Select the digest algorithm. The value of
4fc3dccf009f8ad9522960e54ab7a5c3d601e342Klaus Luettich <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
4fc3dccf009f8ad9522960e54ab7a5c3d601e342Klaus Luettich SHA-256 (SHA256), GOST or SHA-384 (SHA384).
ff21411cdf7c6d8d3acebbdebeade1d5ac502b83Christian Maeder These values are case insensitive.
4fc3dccf009f8ad9522960e54ab7a5c3d601e342Klaus Luettich<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder Specifies the TTL of the DS records.
f0e85ee7e4accfc01f46aa0363acc59fcd248e8aTill Mossakowski<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder Look for key files (or, in keyset mode,
c4040537e6f2153af475dd8b07260a1ee9a56ac0Christian Maeder <code class="filename">keyset-</code> files) in
4b0e0613129ebfc53e3e87985c20a537da91d18dChristian Maeder<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
7f7460e7095628f3437b116ee78d3043d11f8febChristian Maeder Zone file mode: in place of the keyfile name, the argument is
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder the DNS domain name of a zone master file, which can be read
7f7460e7095628f3437b116ee78d3043d11f8febChristian Maeder from <code class="option">file</code>. If the zone name is the same as
a3a7d8b3cdf05c8040c62dbcf9a15dc5042cd721Christian Maeder <code class="option">file</code>, then it may be omitted.
e97bcfa4f74907e1a5ccfc3bc1509d1849cda603Christian Maeder If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
ff21411cdf7c6d8d3acebbdebeade1d5ac502b83Christian Maeder the zone data is read from the standard input. This makes it
ff21411cdf7c6d8d3acebbdebeade1d5ac502b83Christian Maeder possible to use the output of the <span><strong class="command">dig</strong></span>
ff21411cdf7c6d8d3acebbdebeade1d5ac502b83Christian Maeder command as input, as in:
ade09f8be34b77402276c524bf29f2e5df666a94Christian Maeder <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder Include ZSKs when generating DS records. Without this option,
e97bcfa4f74907e1a5ccfc3bc1509d1849cda603Christian Maeder only keys which have the KSK flag set will be converted to DS
2afae0880da7ca73c9376fd4d653ab19833fe858Christian Maeder records and printed. Useful only in zone file mode.
0ea2cddb8715a770e646895e16b7b8085f49167cChristian Maeder<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder Generate a DLV set instead of a DS set. The specified
4b0e0613129ebfc53e3e87985c20a537da91d18dChristian Maeder <code class="option">domain</code> is appended to the name for each
21dae7237ac384abdb94a81e00b3f099873ec623Till Mossakowski record in the set.
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder The DNSSEC Lookaside Validation (DLV) RR is described
b03274844ecd270f9e9331f51cc4236a33e2e671Christian Maeder Keyset mode: in place of the keyfile name, the argument is
89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder the DNS domain name of a keyset file.
b03274844ecd270f9e9331f51cc4236a33e2e671Christian Maeder<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
4b0e0613129ebfc53e3e87985c20a537da91d18dChristian Maeder Specifies the DNS class (default is IN). Useful only
99aecbb3a3f935dd4663a45760a703faabdd04fbChristian Maeder in keyset or zone file mode.
42972ddff400840d46eb54422b60083228b2996cChristian Maeder<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder Sets the debugging level.
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder Prints usage information.
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder Prints version information.
b83ff3749d99d03b641adee264b781039a551addChristian Maeder To build the SHA-256 DS RR from the
b83ff3749d99d03b641adee264b781039a551addChristian Maeder <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
7297175957c5ad3c0498032190b1dee9ec5fb873Christian Maeder keyfile name, the following command would be issued:
17d4f8c5576d93f36cafe68161cdb960ec49ce7cChristian Maeder<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
f1d04fe5072b827d9cc490ebdbca78108241a392Christian Maeder The command would print something like:
f1d04fe5072b827d9cc490ebdbca78108241a392Christian Maeder<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder The keyfile can be designed by the key identification
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
54fb645be0a806e7fd3c0eed5691c2153eb8d518Christian Maeder <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
26ed2a19326560786ff94dfc462309d6d5d862a8Heng Jiang <span class="refentrytitle">dnssec-keygen</span>(8).
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski The keyset file name is built from the <code class="option">directory</code>,
16023c23c9d17743033afd994ad11c386d17b376Christian Maeder the string <code class="filename">keyset-</code> and the
74b841a4b332085d5fd79975a13313c2681ae595Christian Maeder A keyfile error can give a "file not found" even if the file exists.
95c3e5d11dcee331dc3876a9bf0c1d6daa38e2caChristian Maeder<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
74b841a4b332085d5fd79975a13313c2681ae595Christian Maeder <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
3ea571db6dd6e0c42d02de4e56648c7cd86a3734Christian Maeder <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
7f7460e7095628f3437b116ee78d3043d11f8febChristian Maeder<p><span class="corpauthor">Internet Systems Consortium</span>
c092fcac4b8f5c524c22ca579189c4487c13edf7Christian Maeder<table width="100%" summary="Navigation footer">
4b0e0613129ebfc53e3e87985c20a537da91d18dChristian Maeder<a accesskey="p" href="man.dnssec-coverage.html">Prev</a>�</td>
1b05bdb88b90d3c947351f262d7ae7d68f0a4a6fTill Mossakowski<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
7f7460e7095628f3437b116ee78d3043d11f8febChristian Maeder<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-importkey.html">Next</a>
948f37fdb71c544ff4c907bc5863702648cf36e4Christian Maeder<span class="application">dnssec-coverage</span>�</td>
89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
89ab08979dc23d72e9e09c8990a8c44847041d6fChristian Maeder<td width="40%" align="right" valign="top">�<span class="application">dnssec-importkey</span>
f3faf4e4346b6224a3aaeeac11bac8b5c8932a29Christian Maeder<p style="text-align: center;">BIND 9.11.0pre-alpha</p>