man.dnssec-keyfromlabel.html revision 1700442a7751c2bbdafe2d039cebbd8316496957
885f47576842cf3c569315b9a48bd9f0ca03f203Automatic Updater - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
71bd43eebd9d6e42dbcae62b730f5b6508d5acd8Automatic Updater - Copyright (C) 2000-2003 Internet Software Consortium.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
2bb3422dc683c013db7042f5736240de6b86f182Automatic Updater - purpose with or without fee is hereby granted, provided that the above
0bddff542cf2ae1b6595020f2f72ca482c6b438fAutomatic Updater - copyright notice and this permission notice appear in all copies.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
ea854b585041ad19f70f7af15e08144ef2c2bd1bMark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
78cb74fab4665da2e2641ba909c6f59f74cc4193Automatic Updater - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
c89d02f2fb4c06168236d600e86831cff324f763Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
90ff38a0d8deaf5f9c2aa5916d99b2e572d28738Automatic Updater - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
ac4e70ff8955669341f435bc0a734a17c01af124Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
96713299d08c0735c18ebe8772dd2cc1ecd4356aAutomatic Updater<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
3cc98b8ecedcbc8465f1cf2740b966b315662430Automatic Updater<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="prev" href="man.dnssec-importkey.html" title="dnssec-importkey">
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<table width="100%" summary="Navigation header">
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<a accesskey="p" href="man.dnssec-importkey.html">Prev</a>�</td>
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater<th width="60%" align="center">Manual pages</th>
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
aa9c561961e9d877946ebaa8795fa2be054ab7bfEvan Hunt<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<a name="id-1.14.9.7"></a><h2>DESCRIPTION</h2>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater<p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater generates a key pair of files that referencing a key object stored
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater in a cryptographic hardware service module (HSM). The private key
cdfc81e048bd34c1d628380247bda6b80a89e20eAutomatic Updater file can be used for DNSSEC signing of zone data as if it were a
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater conventional signing key created by <span class="command"><strong>dnssec-keygen</strong></span>,
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater but the key material is stored within the HSM, and the actual signing
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater takes place there.
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews The <code class="option">name</code> of the key is specified on the command
eabc9c3c07cd956d3c436bd7614cb162dabdda76Mark Andrews line. This must match the name of the zone for which the key is
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington being generated.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<div class="variablelist"><dl class="variablelist">
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
80faf1588895fd26490f82f95a7a1b771df1c324Automatic Updater Selects the cryptographic algorithm. The value of
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
1a06700908f5a1d9f4a8d51285a0fd971e2f9117Automatic Updater DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews ECDSAP256SHA256 or ECDSAP384SHA384.
db5b7e2cdf150c46e8242d3e2e3ad3f5c7300258Automatic Updater These values are case insensitive.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater If no algorithm is specified, then RSASHA1 will be used by
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson default, unless the <code class="option">-3</code> option is specified,
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater in which case NSEC3RSASHA1 will be used instead. (If
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <code class="option">-3</code> is used and an algorithm is specified,
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews that algorithm will be checked for compatibility with NSEC3.)
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater algorithm, and DSA is recommended.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater Note 2: DH automatically sets the -k flag.
9174e44c14b1cb91a651fa1dc29470438c246ab9Automatic Updater Use an NSEC3-capable algorithm to generate a DNSSEC key.
2a31bd531072824ef252c18303859d6af7451b00Francis Dupont If this option is used and no algorithm is explicitly
52367885450d8f61d4f2d63292beb15ba8f39ac7Automatic Updater set on the command line, NSEC3RSASHA1 will be used by
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Specifies the cryptographic hardware to use.
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater When BIND is built with OpenSSL PKCS#11 support, this defaults
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater to the string "pkcs11", which identifies an OpenSSL engine
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater that can drive a cryptographic accelerator or hardware service
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater module. When BIND is built with native PKCS#11 cryptography
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater (--enable-native-pkcs11), it defaults to the path of the PKCS#11
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater provider library specified via "--with-pkcs11".
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Specifies the label for a key pair in the crypto hardware.
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater PKCS#11 support, the label is an arbitrary string that
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater identifies a particular key. It may be preceded by an
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater optional OpenSSL engine name, followed by a colon, as in
fe80a4909bf62b602feaf246866e9d29f7654194Automatic Updater "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater support, the label is a PKCS#11 URI string in the format
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson Keywords include "token", which identifies the HSM; "object", which
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater identifies the key; and "pin-source", which identifies a file from
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater which the HSM's PIN code can be obtained. The label will be
dd65eb1efb40b1c47d57963192bfc54873b219beAutomatic Updater stored in the on-disk "private" file.
133e6d43fa82e80d3798be4de00f4540f485ec6cAutomatic Updater If the label contains a
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater <code class="option">pin-source</code> field, tools using the generated
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson key files will be able to use the HSM for signing and other
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater operations without any need for an operator to manually enter
d145b64cacc8d9cda51f9924ec70cd4661c3e2cfAutomatic Updater a PIN. Note: Making the HSM's PIN accessible in this manner
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater may reduce the security advantage of using an HSM; be sure
e8c7dc2a5ce48f11c07a67c9923eeb8f419ff19fEvan Hunt this is what you want to do before making use of this feature.
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Specifies the owner type of the key. The value of
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater <code class="option">nametype</code> must either be ZONE (for a DNSSEC
3b6e4c84a525b0b3fc9e8affd8bb9fa5c000345fAutomatic Updater zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater a host (KEY)),
d145b64cacc8d9cda51f9924ec70cd4661c3e2cfAutomatic Updater USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater These values are case insensitive.
0df8ead472f207020f8da22a185fe4b945248ab8Automatic Updater Compatibility mode: generates an old-style key, without
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater any metadata. By default, <span class="command"><strong>dnssec-keyfromlabel</strong></span>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater will include the key's creation date in the metadata stored
bc0a53583d92309bebcf93c408e2f3247ebd3d3cAutomatic Updater with the private key, and other dates may be set there as well
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater (publication date, activation date, etc). Keys that include
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater this data may be incompatible with older versions of BIND; the
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater <code class="option">-C</code> option suppresses them.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Indicates that the DNS record containing the key should have
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater the specified class. If not specified, class IN is used.
7f94d9a8162c9a96b56e66176702b66e79d8e1a2Automatic Updater<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
19b3dc94bce93fa76bd7e066f9298630dbc9dcb4Automatic Updater Set the specified flag in the flag field of the KEY/DNSKEY record.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The only recognized flags are KSK (Key Signing Key) and REVOKE.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Generate a key, but do not publish it or sign with it. This
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater option is incompatible with -P and -A.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Prints a short summary of the options and arguments to
7262eb86f2b465822206122921e2f357218f0cfdAutomatic Updater <span class="command"><strong>dnssec-keyfromlabel</strong></span>.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
bbb069be941f649228760edcc241122933c066d2Automatic Updater Sets the directory in which the key files are to be written.
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater Generate KEY records rather than DNSKEY records.
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater Sets the default TTL to use for this key when it is converted
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews into a DNSKEY RR. If the key is imported into a zone,
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews this is the TTL that will be used for it, unless there was
5ae0e2c8b72fa44237edeb37d1945b1c3535ca39Automatic Updater already a DNSKEY RRset in place, in which case the existing TTL
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews would take precedence. Setting the default TTL to
f7c88d61cc1ad2435b0b7cfaedfc9d5248c0be25Automatic Updater <code class="literal">0</code> or <code class="literal">none</code> removes it.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
7f94d9a8162c9a96b56e66176702b66e79d8e1a2Automatic Updater Sets the protocol value for the key. The protocol
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater is a number between 0 and 255. The default is 3 (DNSSEC).
7f94d9a8162c9a96b56e66176702b66e79d8e1a2Automatic Updater Other possible values for this argument are listed in
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater RFC 2535 and its successors.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
cf7e98f59148b559946a7f1ca728471374f1eef3Automatic Updater Generate a key as an explicit successor to an existing key.
96713299d08c0735c18ebe8772dd2cc1ecd4356aAutomatic Updater The name, algorithm, size, and type of the key will be set
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater to match the predecessor. The activation date of the new
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater key will be set to the inactivation date of the existing
cf7e98f59148b559946a7f1ca728471374f1eef3Automatic Updater one. The publication date will be set to the activation
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater date minus the prepublication interval, which defaults to
361bec4bdec45042897fb479b7071cd05bbd56b9Automatic Updater<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
71bd43eebd9d6e42dbcae62b730f5b6508d5acd8Automatic Updater Indicates the use of the key. <code class="option">type</code> must be
0ce87e5749aabb8eef1e0a37e4bd6e6ffa1d7196Automatic Updater one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington is AUTHCONF. AUTH refers to the ability to authenticate
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater data, and CONF the ability to encrypt data.
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Sets the debugging level.
56e7dc0c24b04210dcbffb180a9e35644fb820daAutomatic Updater Prints version information.
3351ccbd5c1961404044f8273d54dad405f53960Mark Andrews Allows DNSSEC key files to be generated even if the key ID
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington would collide with that of an existing key, in the event of
9513a2a6670951f5cf5477fcfec9f933fcaff628Automatic Updater either key being revoked. (This is only safe to use if you
59528addd704f8d5757b54e540520f74e588a7c7Automatic Updater are sure you won't be using RFC 5011 trust anchor maintenance
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews with either of the keys involved.)
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews<a name="id-1.14.9.9"></a><h2>TIMING OPTIONS</h2>
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater If the argument begins with a '+' or '-', it is interpreted as
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater an offset from the present time. For convenience, if such an offset
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
91216cff91b34c9ff6e846dc23f248219cafe660Andreas Gustafsson then the offset is computed in years (defined as 365 24-hour days,
f2770f6b39a9b2a98afb7a11ed105f73f1570c1eAutomatic Updater ignoring leap years), months (defined as 30 24-hour days), weeks,
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews days, hours, or minutes, respectively. Without a suffix, the offset
efb0e886f18894a1d2489f1ad74ad14b579e11c7Mark Andrews is computed in seconds. To explicitly prevent a date from being
ac4e70ff8955669341f435bc0a734a17c01af124Mark Andrews set, use 'none' or 'never'.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<div class="variablelist"><dl class="variablelist">
b4cebdb6ccde66a8f3e397a1b90b0cf788519d69Automatic Updater<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater Sets the date on which a key is to be published to the zone.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater After that date, the key will be included in the zone but will
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater not be used to sign it. If not set, and if the -G option has
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater not been used, the default is "now".
6c6a121295b30772cbf3dd75a51fb9d883051a0eAutomatic Updater<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Sets the date on which the CDS and CDNSKEY records which match
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater this key are to be published to the zone.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Sets the date on which the key is to be activated. After that
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington date, the key will be included in the zone and used to sign
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington it. If not set, and if the -G option has not been used, the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington default is "now".
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Sets the date on which the key is to be revoked. After that
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington date, the key will be flagged as revoked. It will be included
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington in the zone and will be used to sign it.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Sets the date on which the key is to be retired. After that
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington date, the key will still be included in the zone, but it
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington will not be used to sign it.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Sets the date on which the key is to be deleted. After that
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington date, the key will no longer be included in the zone. (It
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington may remain in the key repository, however.)
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Sets the date on which the CDS and CDNSKEY records which match
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington this key are to be deleted.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington Sets the prepublication interval for a key. If set, then
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the publication and activation dates must be separated by at least
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington this much time. If the activation date is specified but the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington publication date isn't, then the publication date will default
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington to this much time before the activation date; conversely, if
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the publication date is specified but activation date isn't,
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington then activation will be set to this much time after publication.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington If the key is being created as an explicit successor to another
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington key, then the default prepublication interval is 30 days;
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington otherwise it is zero.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington As with date offsets, if the argument is followed by one of
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
a26b22914b7bf25f065afb8cdef983766dcd672bAutomatic Updater interval is measured in years, months, weeks, days, hours,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater or minutes, respectively. Without a suffix, the interval is
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater measured in seconds.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<a name="id-1.14.9.10"></a><h2>GENERATED KEY FILES</h2>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater When <span class="command"><strong>dnssec-keyfromlabel</strong></span> completes
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater to the standard output. This is an identification string for
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater the key files it has generated.
ae7e54b14c946e0984c191554db9abb4893f9349Automatic Updater<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
0d3490f93bb980fde704055e74c1b508987a5fe4Mark Andrews<li class="listitem"><p><code class="filename">nnnn</code> is the key name.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington<li class="listitem"><p><code class="filename">aaa</code> is the numeric representation
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington of the algorithm.
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews<li class="listitem"><p><code class="filename">iiiii</code> is the key identifier (or
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington<p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
aa1d397c4736cd86540555193d71e55fa3b37b2aMark Andrews creates two files, with names based
6c6a121295b30772cbf3dd75a51fb9d883051a0eAutomatic Updater on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington contains the public key, and
6c6a121295b30772cbf3dd75a51fb9d883051a0eAutomatic Updater <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington The <code class="filename">.key</code> file contains a DNS KEY record
a26b22914b7bf25f065afb8cdef983766dcd672bAutomatic Updater can be inserted into a zone file (directly or with a $INCLUDE
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater The <code class="filename">.private</code> file contains
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater algorithm-specific
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater fields. For obvious security reasons, this file does not have
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater general read permission.
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<a name="id-1.14.9.11"></a><h2>SEE ALSO</h2>
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
ce9cad6bb04869c5e94d9dc721032b25117f9210Automatic Updater <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
9cd5eb6fe0f26d65724b99216cb31dcdd12e4afdAutomatic Updater <em class="citetitle">The PKCS#11 URI Scheme (draft-pechanec-pkcs11uri-13)</em>.
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<table width="100%" summary="Navigation footer">
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<a accesskey="p" href="man.dnssec-importkey.html">Prev</a>�</td>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<span class="application">dnssec-importkey</span>�</td>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
9e3a7b0faf417a10f5f689edf288807b2d5eedc5Brian Wellington<td width="40%" align="right" valign="top">�<span class="application">dnssec-keygen</span>
a26b22914b7bf25f065afb8cdef983766dcd672bAutomatic Updater<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.0b2</p>