man.dnssec-keygen.html revision 603de7394f5a466ea39a33a6eea2022885ec3f87
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - Copyright (C) 2000-2003 Internet Software Consortium.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - Permission to use, copy, modify, and/or distribute this software for any
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - purpose with or without fee is hereby granted, provided that the above
5c45bb188ab729e501e48732842cb9de6a9813beAlex Valavanis - copyright notice and this permission notice appear in all copies.
eb4caa8f4cdc2955b58dcd2de06fe770533414c8Jon A. Cruz - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
d431763a9ec8059aa4962688de8144319969fb0fjohanengelen - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm - PERFORMANCE OF THIS SOFTWARE.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<!-- $Id$ -->
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<link rel="prev" href="man.dnssec-keyfromlabel.html" title="dnssec-keyfromlabel">
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<link rel="next" href="man.dnssec-revoke.html" title="dnssec-revoke">
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
b5a129ca7cf5c8e074b39ea5dbc2cc978187078bjohanengelen<table width="100%" summary="Navigation header">
b5a129ca7cf5c8e074b39ea5dbc2cc978187078bjohanengelen<tr><th colspan="3" align="center"><span class="application">dnssec-keygen</span></th></tr>
b5a129ca7cf5c8e074b39ea5dbc2cc978187078bjohanengelen<a accesskey="p" href="man.dnssec-keyfromlabel.html">Prev</a>�</td>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-revoke.html">Next</a>
0903335a0099bd7ee779925f43a15a2216a0e863johanengelen<a name="man.dnssec-keygen"></a><div class="titlepage"></div>
cef9e2c431b417aea98429860c6021849f099fcfKris De Gussem<p><span class="application">dnssec-keygen</span> — DNSSEC key generation tool</p>
cef9e2c431b417aea98429860c6021849f099fcfKris De Gussem<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<p><span><strong class="command">dnssec-keygen</strong></span>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm and RFC 4034. It can also generate keys for use with
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY
b5a129ca7cf5c8e074b39ea5dbc2cc978187078bjohanengelen (Transaction Key) as defined in RFC 2930.
c11199b2b0b6b7fbfe61f562566e0cd15604cc43Liam P. White The <code class="option">name</code> of the key is specified on the command
b5a129ca7cf5c8e074b39ea5dbc2cc978187078bjohanengelen line. For DNSSEC keys, this must match the name of the zone for
b5a129ca7cf5c8e074b39ea5dbc2cc978187078bjohanengelen which the key is being generated.
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Selects the cryptographic algorithm. For DNSSEC keys, the value
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm ECDSAP256SHA256 or ECDSAP384SHA384.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm case insensitive.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm If no algorithm is specified, then RSASHA1 will be used by
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm default, unless the <code class="option">-3</code> option is specified,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm in which case NSEC3RSASHA1 will be used instead. (If
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm <code class="option">-3</code> is used and an algorithm is specified,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm that algorithm will be checked for compatibility with NSEC3.)
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
79291918d036d77d586b6eba265d8d2ac0a7fee5cilix algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm mandatory.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm automatically set the -T KEY option.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Specifies the number of bits in the key. The choice of key
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm size depends on the algorithm used. RSA keys must be
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm between 512 and 2048 bits. Diffie Hellman keys must be between
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm 128 and 4096 bits. DSA keys must be between 512 and 1024
eaa9bdc7bf7b73397e536edd47490d84e4420bd8bryce bits and an exact multiple of 64. HMAC keys must be
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm between 1 and 512 bits. Elliptic curve algorithms don't need
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm this parameter.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm The key size does not need to be specified if using a default
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm algorithm. The default key size is 1024 bits for zone signing
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm keys (ZSKs) and 2048 bits for key signing keys (KSKs,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm generated with <code class="option">-f KSK</code>). However, if an
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm algorithm is explicitly specified with the <code class="option">-a</code>,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm then there is no default key size, and the <code class="option">-b</code>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm must be used.
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White Specifies the owner type of the key. The value of
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White <code class="option">nametype</code> must either be ZONE (for a DNSSEC
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White a host (KEY)),
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White These values are case insensitive. Defaults to ZONE for DNSKEY
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White Use an NSEC3-capable algorithm to generate a DNSSEC key.
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White If this option is used and no algorithm is explicitly
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White set on the command line, NSEC3RSASHA1 will be used by
f83dd38ed9c631b7644b7c82c821fa9fbbb82352Liam P. White default. Note that RSASHA256, RSASHA512, ECCGOST,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm are NSEC3-capable.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Compatibility mode: generates an old-style key, without
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm any metadata. By default, <span><strong class="command">dnssec-keygen</strong></span>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm will include the key's creation date in the metadata stored
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm with the private key, and other dates may be set there as well
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm (publication date, activation date, etc). Keys that include
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm this data may be incompatible with older versions of BIND; the
106bf69f0520ef3b349214008cc1f91c68e69daaJabiertxof<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
106bf69f0520ef3b349214008cc1f91c68e69daaJabiertxof Indicates that the DNS record containing the key should have
a7b98b4dadda9f675e57ee1b78a9e1d2a5b3844fjtx the specified class. If not specified, class IN is used.
106bf69f0520ef3b349214008cc1f91c68e69daaJabiertxof<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Specifies the cryptographic hardware to use, when applicable.
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof When BIND is built with OpenSSL PKCS#11 support, this defaults
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof to the string "pkcs11", which identifies an OpenSSL engine
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof that can drive a cryptographic accelerator or hardware service
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof module. When BIND is built with native PKCS#11 cryptography
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof (--enable-native-pkcs11), it defaults to the path of the PKCS#11
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof provider library specified via "--with-pkcs11".
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof Set the specified flag in the flag field of the KEY/DNSKEY record.
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof The only recognized flags are KSK (Key Signing Key) and REVOKE.
3ab4e87511c6a42f29370bf22a9afcf759ca1d0dJabiertxof Generate a key, but do not publish it or sign with it. This
a7b98b4dadda9f675e57ee1b78a9e1d2a5b3844fjtx option is incompatible with -P and -A.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm If generating a Diffie Hellman key, use this generator.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Allowed values are 2 and 5. If no generator
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm is specified, a known prime from RFC 2539 will be used
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm if possible; otherwise the default is 2.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Prints a short summary of the options and arguments to
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm <span><strong class="command">dnssec-keygen</strong></span>.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Sets the directory in which the key files are to be written.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Deprecated in favor of -T KEY.
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm Sets the default TTL to use for this key when it is converted
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm into a DNSKEY RR. If the key is imported into a zone,
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm this is the TTL that will be used for it, unless there was
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm already a DNSKEY RRset in place, in which case the existing TTL
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm would take precedence. If this value is not set and there
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm is no existing DNSKEY RRset, the TTL will default to the
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm SOA TTL. Setting the default TTL to <code class="literal">0</code>
f07bfd5a05d43a6d11f7cd442f085149092dea88pjrm or <code class="literal">none</code> is the same as leaving it unset.