man.dnssec-keyfromlabel.html revision 892503bd484c106493e3c8053155b364a522ec03
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - Copyright (C) 2000-2003 Internet Software Consortium.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - Permission to use, copy, modify, and/or distribute this software for any
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - purpose with or without fee is hereby granted, provided that the above
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - copyright notice and this permission notice appear in all copies.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk - PERFORMANCE OF THIS SOFTWARE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<!-- $Id$ -->
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<link rel="prev" href="man.dnssec-importkey.html" title="dnssec-importkey">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<a accesskey="p" href="man.dnssec-importkey.html">Prev</a>�</td>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk gets keys with the given label from a crypto hardware and builds
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk key files for DNSSEC (Secure DNS), as defined in RFC 2535
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk and RFC 4034.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="option">name</code> of the key is specified on the command
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk line. This must match the name of the zone for which the key is
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk being generated.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Selects the cryptographic algorithm. The value of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk ECDSAP256SHA256 or ECDSAP384SHA384.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk These values are case insensitive.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If no algorithm is specified, then RSASHA1 will be used by
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk default, unless the <code class="option">-3</code> option is specified,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk in which case NSEC3RSASHA1 will be used instead. (If
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">-3</code> is used and an algorithm is specified,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk that algorithm will be checked for compatibility with NSEC3.)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk algorithm, and DSA is recommended.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Note 2: DH automatically sets the -k flag.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Use an NSEC3-capable algorithm to generate a DNSSEC key.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If this option is used and no algorithm is explicitly
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk set on the command line, NSEC3RSASHA1 will be used by
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Specifies the cryptographic hardware to use.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When BIND is built with OpenSSL PKCS#11 support, this defaults
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk to the string "pkcs11", which identifies an OpenSSL engine
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk that can drive a cryptographic accelerator or hardware service
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk module. When BIND is built with native PKCS#11 cryptography
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk (--enable-native-pkcs11), it defaults to the path of the PKCS#11
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk provider library specified via "--with-pkcs11".
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Specifies the label for a key pair in the crypto hardware.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk PKCS#11 support, the label is an arbitrary string that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk identifies a particular key. It may be preceded by an
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk optional OpenSSL engine name, followed by a colon, as in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk support, the label is a PKCS#11 URI string in the format
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Keywords include "token", which identifies the HSM; "object", which
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk identifies the key; and "pin-source", which identifies a file from
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk which the HSM's PIN code can be obtained. The label will be
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk stored in the on-disk "private" file.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If the label contains a
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">pin-source</code> field, tools using the generated
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk key files will be able to use the HSM for signing and other
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk operations without any need for an operator to manually enter
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk a PIN. Note: Making the HSM's PIN accessible in this manner
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk may reduce the security advantage of using an HSM; be sure
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk this is what you want to do before making use of this feature.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Specifies the owner type of the key. The value of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="option">nametype</code> must either be ZONE (for a DNSSEC
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk a host (KEY)),
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk These values are case insensitive.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Compatibility mode: generates an old-style key, without
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk any metadata. By default, <span><strong class="command">dnssec-keyfromlabel</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk will include the key's creation date in the metadata stored
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk with the private key, and other dates may be set there as well
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk (publication date, activation date, etc). Keys that include
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk this data may be incompatible with older versions of BIND; the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Indicates that the DNS record containing the key should have
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the specified class. If not specified, class IN is used.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Set the specified flag in the flag field of the KEY/DNSKEY record.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The only recognized flags are KSK (Key Signing Key) and REVOKE.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Generate a key, but do not publish it or sign with it. This
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk option is incompatible with -P and -A.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Prints a short summary of the options and arguments to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span><strong class="command">dnssec-keyfromlabel</strong></span>.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the directory in which the key files are to be written.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Generate KEY records rather than DNSKEY records.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the default TTL to use for this key when it is converted
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk into a DNSKEY RR. If the key is imported into a zone,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk this is the TTL that will be used for it, unless there was
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk already a DNSKEY RRset in place, in which case the existing TTL
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk would take precedence. Setting the default TTL to
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="literal">0</code> or <code class="literal">none</code> removes it.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the protocol value for the key. The protocol
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is a number between 0 and 255. The default is 3 (DNSSEC).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Other possible values for this argument are listed in
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk RFC 2535 and its successors.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Indicates the use of the key. <code class="option">type</code> must be
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is AUTHCONF. AUTH refers to the ability to authenticate
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk data, and CONF the ability to encrypt data.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the debugging level.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Allows DNSSEC key files to be generated even if the key ID
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk would collide with that of an existing key, in the event of
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk either key being revoked. (This is only safe to use if you
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk are sure you won't be using RFC 5011 trust anchor maintenance
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk with either of the keys involved.)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk If the argument begins with a '+' or '-', it is interpreted as
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk an offset from the present time. For convenience, if such an offset
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk then the offset is computed in years (defined as 365 24-hour days,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk ignoring leap years), months (defined as 30 24-hour days), weeks,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk days, hours, or minutes, respectively. Without a suffix, the offset
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk is computed in seconds. To explicitly prevent a date from being
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk set, use 'none' or 'never'.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the date on which a key is to be published to the zone.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk After that date, the key will be included in the zone but will
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk not be used to sign it. If not set, and if the -G option has
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk not been used, the default is "now".
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the date on which the key is to be activated. After that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk date, the key will be included in the zone and used to sign
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk it. If not set, and if the -G option has not been used, the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk default is "now".
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the date on which the key is to be revoked. After that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk date, the key will be flagged as revoked. It will be included
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk in the zone and will be used to sign it.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the date on which the key is to be retired. After that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk date, the key will still be included in the zone, but it
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk will not be used to sign it.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk Sets the date on which the key is to be deleted. After that
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk date, the key will no longer be included in the zone. (It
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk may remain in the key repository, however.)
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk successfully,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk to the standard output. This is an identification string for
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk the key files it has generated.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<li><p><code class="filename">nnnn</code> is the key name.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<li><p><code class="filename">aaa</code> is the numeric representation
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk of the algorithm.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<li><p><code class="filename">iiiii</code> is the key identifier (or
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk footprint).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk creates two files, with names based
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk contains the public key, and
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk private key.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="filename">.key</code> file contains a DNS KEY record
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk can be inserted into a zone file (directly or with a $INCLUDE
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk statement).
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk The <code class="filename">.private</code> file contains
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk algorithm-specific
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk fields. For obvious security reasons, this file does not have
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk general read permission.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk <em class="citetitle">The PKCS#11 URI Scheme (draft-pechanec-pkcs11uri-13)</em>.
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<p><span class="corpauthor">Internet Systems Consortium</span>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<a accesskey="p" href="man.dnssec-importkey.html">Prev</a>�</td>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
45916cd2fec6e79bca5dee0421bd39e3c2910d1ejpk<td width="40%" align="right" valign="top">�<span class="application">dnssec-keygen</span>