man.dnssec-keyfromlabel.html revision 990d0e893f5b70e735cdf990af66e9ec6e91fa78
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - Copyright (C) 2000-2003 Internet Software Consortium.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - Permission to use, copy, modify, and/or distribute this software for any
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - purpose with or without fee is hereby granted, provided that the above
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - copyright notice and this permission notice appear in all copies.
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
37867092eb9f5796a0dabbb51ff918585421eb01jvergara - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac - PERFORMANCE OF THIS SOFTWARE.
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac<!-- $Id$ -->
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
a5b9f8fb834b1b2208e59a2fa76714bd91a5f147violette<link rel="prev" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara gets keys with the given label from a crypto hardware and builds
37867092eb9f5796a0dabbb51ff918585421eb01jvergara key files for DNSSEC (Secure DNS), as defined in RFC 2535
37867092eb9f5796a0dabbb51ff918585421eb01jvergara and RFC 4034.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara The <code class="option">name</code> of the key is specified on the command
37867092eb9f5796a0dabbb51ff918585421eb01jvergara line. This must match the name of the zone for which the key is
37867092eb9f5796a0dabbb51ff918585421eb01jvergara being generated.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Selects the cryptographic algorithm. The value of
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara ECDSAP256SHA256 or ECDSAP384SHA384.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara These values are case insensitive.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara If no algorithm is specified, then RSASHA1 will be used by
37867092eb9f5796a0dabbb51ff918585421eb01jvergara default, unless the <code class="option">-3</code> option is specified,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara in which case NSEC3RSASHA1 will be used instead. (If
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <code class="option">-3</code> is used and an algorithm is specified,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara that algorithm will be checked for compatibility with NSEC3.)
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
37867092eb9f5796a0dabbb51ff918585421eb01jvergara algorithm, and DSA is recommended.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Note 2: DH automatically sets the -k flag.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Use an NSEC3-capable algorithm to generate a DNSSEC key.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara If this option is used and no algorithm is explicitly
37867092eb9f5796a0dabbb51ff918585421eb01jvergara set on the command line, NSEC3RSASHA1 will be used by
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Specifies the name of the crypto hardware (OpenSSL engine).
37867092eb9f5796a0dabbb51ff918585421eb01jvergara When compiled with PKCS#11 support it defaults to "pkcs11".
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Specifies the label of the key pair in the crypto hardware.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara The label may be preceded by an optional OpenSSL engine name,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara separated by a colon, as in "pkcs11:keylabel".
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Specifies the owner type of the key. The value of
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <code class="option">nametype</code> must either be ZONE (for a DNSSEC
37867092eb9f5796a0dabbb51ff918585421eb01jvergara zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
37867092eb9f5796a0dabbb51ff918585421eb01jvergara a host (KEY)),
37867092eb9f5796a0dabbb51ff918585421eb01jvergara USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
37867092eb9f5796a0dabbb51ff918585421eb01jvergara These values are case insensitive.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Compatibility mode: generates an old-style key, without
37867092eb9f5796a0dabbb51ff918585421eb01jvergara any metadata. By default, <span><strong class="command">dnssec-keyfromlabel</strong></span>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara will include the key's creation date in the metadata stored
37867092eb9f5796a0dabbb51ff918585421eb01jvergara with the private key, and other dates may be set there as well
37867092eb9f5796a0dabbb51ff918585421eb01jvergara (publication date, activation date, etc). Keys that include
37867092eb9f5796a0dabbb51ff918585421eb01jvergara this data may be incompatible with older versions of BIND; the
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <code class="option">-C</code> option suppresses them.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Indicates that the DNS record containing the key should have
37867092eb9f5796a0dabbb51ff918585421eb01jvergara the specified class. If not specified, class IN is used.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Set the specified flag in the flag field of the KEY/DNSKEY record.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara The only recognized flags are KSK (Key Signing Key) and REVOKE.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Generate a key, but do not publish it or sign with it. This
37867092eb9f5796a0dabbb51ff918585421eb01jvergara option is incompatible with -P and -A.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Prints a short summary of the options and arguments to
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <span><strong class="command">dnssec-keyfromlabel</strong></span>.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the directory in which the key files are to be written.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Generate KEY records rather than DNSKEY records.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the default TTL to use for this key when it is converted
37867092eb9f5796a0dabbb51ff918585421eb01jvergara into a DNSKEY RR. If the key is imported into a zone,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara this is the TTL that will be used for it, unless there was
37867092eb9f5796a0dabbb51ff918585421eb01jvergara already a DNSKEY RRset in place, in which case the existing TTL
37867092eb9f5796a0dabbb51ff918585421eb01jvergara would take precedence. Setting the default TTL to
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <code class="literal">0</code> or <code class="literal">none</code> removes it.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the protocol value for the key. The protocol
37867092eb9f5796a0dabbb51ff918585421eb01jvergara is a number between 0 and 255. The default is 3 (DNSSEC).
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Other possible values for this argument are listed in
37867092eb9f5796a0dabbb51ff918585421eb01jvergara RFC 2535 and its successors.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Indicates the use of the key. <code class="option">type</code> must be
37867092eb9f5796a0dabbb51ff918585421eb01jvergara one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
37867092eb9f5796a0dabbb51ff918585421eb01jvergara is AUTHCONF. AUTH refers to the ability to authenticate
37867092eb9f5796a0dabbb51ff918585421eb01jvergara data, and CONF the ability to encrypt data.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the debugging level.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Allows DNSSEC key files to be generated even if the key ID
37867092eb9f5796a0dabbb51ff918585421eb01jvergara would collide with that of an existing key, in the event of
37867092eb9f5796a0dabbb51ff918585421eb01jvergara either key being revoked. (This is only safe to use if you
37867092eb9f5796a0dabbb51ff918585421eb01jvergara are sure you won't be using RFC 5011 trust anchor maintenance
37867092eb9f5796a0dabbb51ff918585421eb01jvergara with either of the keys involved.)
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara If the argument begins with a '+' or '-', it is interpreted as
37867092eb9f5796a0dabbb51ff918585421eb01jvergara an offset from the present time. For convenience, if such an offset
37867092eb9f5796a0dabbb51ff918585421eb01jvergara is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
37867092eb9f5796a0dabbb51ff918585421eb01jvergara then the offset is computed in years (defined as 365 24-hour days,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara ignoring leap years), months (defined as 30 24-hour days), weeks,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara days, hours, or minutes, respectively. Without a suffix, the offset
37867092eb9f5796a0dabbb51ff918585421eb01jvergara is computed in seconds.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the date on which a key is to be published to the zone.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara After that date, the key will be included in the zone but will
37867092eb9f5796a0dabbb51ff918585421eb01jvergara not be used to sign it. If not set, and if the -G option has
37867092eb9f5796a0dabbb51ff918585421eb01jvergara not been used, the default is "now".
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the date on which the key is to be activated. After that
37867092eb9f5796a0dabbb51ff918585421eb01jvergara date, the key will be included in the zone and used to sign
37867092eb9f5796a0dabbb51ff918585421eb01jvergara it. If not set, and if the -G option has not been used, the
37867092eb9f5796a0dabbb51ff918585421eb01jvergara default is "now".
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the date on which the key is to be revoked. After that
37867092eb9f5796a0dabbb51ff918585421eb01jvergara date, the key will be flagged as revoked. It will be included
37867092eb9f5796a0dabbb51ff918585421eb01jvergara in the zone and will be used to sign it.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the date on which the key is to be retired. After that
37867092eb9f5796a0dabbb51ff918585421eb01jvergara date, the key will still be included in the zone, but it
37867092eb9f5796a0dabbb51ff918585421eb01jvergara will not be used to sign it.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara Sets the date on which the key is to be deleted. After that
37867092eb9f5796a0dabbb51ff918585421eb01jvergara date, the key will no longer be included in the zone. (It
37867092eb9f5796a0dabbb51ff918585421eb01jvergara may remain in the key repository, however.)
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<a name="id2620270"></a><h2>GENERATED KEY FILES</h2>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
37867092eb9f5796a0dabbb51ff918585421eb01jvergara successfully,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara to the standard output. This is an identification string for
37867092eb9f5796a0dabbb51ff918585421eb01jvergara the key files it has generated.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<li><p><code class="filename">nnnn</code> is the key name.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<li><p><code class="filename">aaa</code> is the numeric representation
37867092eb9f5796a0dabbb51ff918585421eb01jvergara of the algorithm.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<li><p><code class="filename">iiiii</code> is the key identifier (or
37867092eb9f5796a0dabbb51ff918585421eb01jvergara footprint).
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara creates two files, with names based
37867092eb9f5796a0dabbb51ff918585421eb01jvergara on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara contains the public key, and
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
37867092eb9f5796a0dabbb51ff918585421eb01jvergara private key.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara The <code class="filename">.key</code> file contains a DNS KEY record
37867092eb9f5796a0dabbb51ff918585421eb01jvergara can be inserted into a zone file (directly or with a $INCLUDE
37867092eb9f5796a0dabbb51ff918585421eb01jvergara statement).
37867092eb9f5796a0dabbb51ff918585421eb01jvergara The <code class="filename">.private</code> file contains
37867092eb9f5796a0dabbb51ff918585421eb01jvergara algorithm-specific
37867092eb9f5796a0dabbb51ff918585421eb01jvergara fields. For obvious security reasons, this file does not have
37867092eb9f5796a0dabbb51ff918585421eb01jvergara general read permission.
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<p><span class="corpauthor">Internet Systems Consortium</span>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<span class="application">dnssec-dsfromkey</span>�</td>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
37867092eb9f5796a0dabbb51ff918585421eb01jvergara<td width="40%" align="right" valign="top">�<span class="application">dnssec-keygen</span>