man.dnssec-importkey.html revision aa1905addf2f33d90aa020080e4e77a8651e829a
842ae4bd224140319ae7feec1872b93dfd491143fielding - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
842ae4bd224140319ae7feec1872b93dfd491143fielding - Copyright (C) 2000-2003 Internet Software Consortium.
842ae4bd224140319ae7feec1872b93dfd491143fielding - Permission to use, copy, modify, and/or distribute this software for any
842ae4bd224140319ae7feec1872b93dfd491143fielding - purpose with or without fee is hereby granted, provided that the above
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding - copyright notice and this permission notice appear in all copies.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
04891cf70e0bfc38bfb027541dc821f04c754ff7nd - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
04891cf70e0bfc38bfb027541dc821f04c754ff7nd - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
04891cf70e0bfc38bfb027541dc821f04c754ff7nd - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
04891cf70e0bfc38bfb027541dc821f04c754ff7nd - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
04891cf70e0bfc38bfb027541dc821f04c754ff7nd - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding - PERFORMANCE OF THIS SOFTWARE.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<!-- $Id$ -->
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
33898360b028c97469e0110a31651c576b1d7ff1nd<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
193e6dc13eb76fc4bc4c2f7c0b6faf2dea4f673fdgaudet<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
1b21d7b3d97def358b2e923655edeb16613a1c31gstein<link rel="prev" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
1b21d7b3d97def358b2e923655edeb16613a1c31gstein<link rel="next" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel">
b6055b7832a0e4d0818416252fff5925aaebae4brbb<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
1b21d7b3d97def358b2e923655edeb16613a1c31gstein<tr><th colspan="3" align="center"><span class="application">dnssec-importkey</span></th></tr>
1b21d7b3d97def358b2e923655edeb16613a1c31gstein<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
9625528fcf4fa27288f3be080a1979c8ef60d7dfrbb<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<a name="man.dnssec-importkey"></a><div class="titlepage"></div>
c9a95767fbf0f5fb0976a06b97a256033925e433rbb<p><span class="application">dnssec-importkey</span> — Import DNSKEY records from external systems so they can be managed.</p>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code> [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {<code class="option">keyfile</code>}</p></div>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code> {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe<p><span><strong class="command">dnssec-importkey</strong></span>
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe reads a public DNSKEY record and generates a pair of
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe .key/.private files. The DNSKEY record may be read from an
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe existing .key file, in which case a corresponding .private file
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe will be generated, or it may be read from any other file or
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe from the standard input, in which case both .key and .private
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe files will be generated.
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe The newly-created .private file does <span class="emphasis"><em>not</em></span>
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe contain private key data, and cannot be used for signing.
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe However, having a .private file makes it possible to set
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe publication (<code class="option">-P</code>) and deletion
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe (<code class="option">-D</code>) times for the key, which means the
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe public key can be added to and removed from the DNSKEY RRset
f49cf8ce86a01c90d5d843fc27e19d2802dd0f77wrowe on schedule even if the true private key is stored offline.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Zone file mode: instead of a public keyfile name, the argument
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding is the DNS domain name of a zone master file, which can be read
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding from <code class="option">file</code>. If the domain name is the same as
782b2a418d5f38c4825ea40b5da76fb924343643aaron <code class="option">file</code>, then it may be omitted.
782b2a418d5f38c4825ea40b5da76fb924343643aaron If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
82efd02118af953c3840478fa5e979a4194a579fwrowe the zone data is read from the standard input.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Sets the directory in which the key files are to reside.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Sets the default TTL to use for this key when it is converted
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding into a DNSKEY RR. If the key is imported into a zone,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding this is the TTL that will be used for it, unless there was
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding already a DNSKEY RRset in place, in which case the existing TTL
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding would take precedence. Setting the default TTL to
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding <code class="literal">0</code> or <code class="literal">none</code> removes it.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Emit usage message and exit.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Sets the debugging level.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Prints version information.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding If the argument begins with a '+' or '-', it is interpreted as
7ed5992392d5babab20be4ce4029ad17ae062b5aianh an offset from the present time. For convenience, if such an offset
fffe2d3830e52ed28703d042c5049b5e8fa047e2niq is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
d101208302341584448ecf956873d7db97788701takashi then the offset is computed in years (defined as 365 24-hour days,
d101208302341584448ecf956873d7db97788701takashi ignoring leap years), months (defined as 30 24-hour days), weeks,
82efd02118af953c3840478fa5e979a4194a579fwrowe days, hours, or minutes, respectively. Without a suffix, the offset
82efd02118af953c3840478fa5e979a4194a579fwrowe is computed in seconds. To explicitly prevent a date from being
82efd02118af953c3840478fa5e979a4194a579fwrowe set, use 'none' or 'never'.
77e04697cbdb146d93cd22ad9f1c5e74ef8f9cbcwrowe<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding Sets the date on which a key is to be published to the zone.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding After that date, the key will be included in the zone but will
77e04697cbdb146d93cd22ad9f1c5e74ef8f9cbcwrowe not be used to sign it.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm Sets the date on which the key is to be deleted. After that
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm date, the key will no longer be included in the zone. (It
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm may remain in the key repository, however.)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding A keyfile can be designed by the key identification
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding <span class="refentrytitle">dnssec-keygen</span>(8).
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
99d6d3207e24ba1f8eba77ef903948d738886cf5nd <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
7ed5992392d5babab20be4ce4029ad17ae062b5aianh<p><span class="corpauthor">Internet Systems Consortium</span>
24c47621d3cf22e829ade8ba254cb24422c9980arpluem<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
24c47621d3cf22e829ade8ba254cb24422c9980arpluem<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
272a4b5b6fd7b244c3eebadad76a196d5f145bc5rpluem<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keyfromlabel.html">Next</a>
fffe2d3830e52ed28703d042c5049b5e8fa047e2niq<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
fffe2d3830e52ed28703d042c5049b5e8fa047e2niq<td width="40%" align="right" valign="top">�<span class="application">dnssec-keyfromlabel</span>