man.dnssec-keyfromlabel.html revision 9d5a84057d77e1de7ccdcf3cfdeff78db4706fb8
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - Copyright (C) 2000-2003 Internet Software Consortium.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - Permission to use, copy, modify, and/or distribute this software for any
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - purpose with or without fee is hereby granted, provided that the above
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - copyright notice and this permission notice appear in all copies.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync - PERFORMANCE OF THIS SOFTWARE.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<!-- $Id: man.dnssec-keyfromlabel.html,v 1.126 2011/07/29 01:14:29 tbox Exp $ -->
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<link rel="prev" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync gets keys with the given label from a crypto hardware and builds
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync key files for DNSSEC (Secure DNS), as defined in RFC 2535
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync and RFC 4034.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync The <code class="option">name</code> of the key is specified on the command
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync line. This must match the name of the zone for which the key is
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync being generated.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Selects the cryptographic algorithm. The value of
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512 or ECCGOST.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync These values are case insensitive.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync If no algorithm is specified, then RSASHA1 will be used by
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync default, unless the <code class="option">-3</code> option is specified,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync in which case NSEC3RSASHA1 will be used instead. (If
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync <code class="option">-3</code> is used and an algorithm is specified,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync that algorithm will be checked for compatibility with NSEC3.)
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync algorithm, and DSA is recommended.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Note 2: DH automatically sets the -k flag.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Use an NSEC3-capable algorithm to generate a DNSSEC key.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync If this option is used and no algorithm is explicitly
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync set on the command line, NSEC3RSASHA1 will be used by
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Specifies the name of the crypto hardware (OpenSSL engine).
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync When compiled with PKCS#11 support it defaults to "pkcs11".
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Specifies the label of the key pair in the crypto hardware.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync The label may be preceded by an optional OpenSSL engine name,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync separated by a colon, as in "pkcs11:keylabel".
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Specifies the owner type of the key. The value of
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync <code class="option">nametype</code> must either be ZONE (for a DNSSEC
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync a host (KEY)),
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync These values are case insensitive.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Compatibility mode: generates an old-style key, without
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync any metadata. By default, <span><strong class="command">dnssec-keyfromlabel</strong></span>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync will include the key's creation date in the metadata stored
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync with the private key, and other dates may be set there as well
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync (publication date, activation date, etc). Keys that include
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync this data may be incompatible with older versions of BIND; the
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync <code class="option">-C</code> option suppresses them.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Indicates that the DNS record containing the key should have
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync the specified class. If not specified, class IN is used.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Set the specified flag in the flag field of the KEY/DNSKEY record.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync The only recognized flags are KSK (Key Signing Key) and REVOKE.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Generate a key, but do not publish it or sign with it. This
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync option is incompatible with -P and -A.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Prints a short summary of the options and arguments to
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync <span><strong class="command">dnssec-keyfromlabel</strong></span>.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Sets the directory in which the key files are to be written.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Generate KEY records rather than DNSKEY records.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Sets the default TTL to use for this key when it is converted
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync into a DNSKEY RR. If the key is imported into a zone,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync this is the TTL that will be used for it, unless there was
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync already a DNSKEY RRset in place, in which case the existing TTL
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync would take precedence. Setting the default TTL to
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync <code class="literal">0</code> or <code class="literal">none</code> removes it.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Sets the protocol value for the key. The protocol
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync is a number between 0 and 255. The default is 3 (DNSSEC).
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Other possible values for this argument are listed in
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync RFC 2535 and its successors.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Indicates the use of the key. <code class="option">type</code> must be
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync is AUTHCONF. AUTH refers to the ability to authenticate
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync data, and CONF the ability to encrypt data.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Sets the debugging level.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Allows DNSSEC key files to be generated even if the key ID
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync would collide with that of an existing key, in the event of
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync either key being revoked. (This is only safe to use if you
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync are sure you won't be using RFC 5011 trust anchor maintenance
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync with either of the keys involved.)
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync If the argument begins with a '+' or '-', it is interpreted as
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync an offset from the present time. For convenience, if such an offset
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync then the offset is computed in years (defined as 365 24-hour days,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync ignoring leap years), months (defined as 30 24-hour days), weeks,
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync days, hours, or minutes, respectively. Without a suffix, the offset
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync is computed in seconds.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Sets the date on which a key is to be published to the zone.
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync After that date, the key will be included in the zone but will
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync not be used to sign it. If not set, and if the -G option has
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync not been used, the default is "now".
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync Sets the date on which the key is to be activated. After that
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync date, the key will be included in the zone and used to sign
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync it. If not set, and if the -G option has not been used, the
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync default is "now".
8c3d541c7ee7442f570b22eca3d82808b35b0385vboxsync<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>