man.dnssec-revoke.html revision 3c9cf7efb97991f9871bc5633e7ed1cae0932a37
64185f9824e42f21ca7b9ae6c004484215c031a7rbb - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC")
2915eb26d1a16c56cdd91fed07566557d42645bdfielding - Copyright (C) 2000-2003 Internet Software Consortium.
2915eb26d1a16c56cdd91fed07566557d42645bdfielding - Permission to use, copy, modify, and/or distribute this software for any
2915eb26d1a16c56cdd91fed07566557d42645bdfielding - purpose with or without fee is hereby granted, provided that the above
6ca0e6973c8176100f4a426444823ae5e777e28fsascha - copyright notice and this permission notice appear in all copies.
6ca0e6973c8176100f4a426444823ae5e777e28fsascha - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
6ca0e6973c8176100f4a426444823ae5e777e28fsascha - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
64185f9824e42f21ca7b9ae6c004484215c031a7rbb - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
6ca0e6973c8176100f4a426444823ae5e777e28fsascha - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
6ca0e6973c8176100f4a426444823ae5e777e28fsascha - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
64185f9824e42f21ca7b9ae6c004484215c031a7rbb - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
6ca0e6973c8176100f4a426444823ae5e777e28fsascha - PERFORMANCE OF THIS SOFTWARE.
64185f9824e42f21ca7b9ae6c004484215c031a7rbb<!-- $Id: man.dnssec-revoke.html,v 1.92 2012/01/16 01:14:56 tbox Exp $ -->
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<link rel="prev" href="man.dnssec-keygen.html" title="dnssec-keygen">
64185f9824e42f21ca7b9ae6c004484215c031a7rbb<link rel="next" href="man.dnssec-settime.html" title="dnssec-settime">
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
64185f9824e42f21ca7b9ae6c004484215c031a7rbb<tr><th colspan="3" align="center"><span class="application">dnssec-revoke</span></th></tr>
64185f9824e42f21ca7b9ae6c004484215c031a7rbb<a accesskey="p" href="man.dnssec-keygen.html">Prev</a>�</td>
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-settime.html">Next</a>
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<a name="man.dnssec-revoke"></a><div class="titlepage"></div>
2915eb26d1a16c56cdd91fed07566557d42645bdfielding<p><span class="application">dnssec-revoke</span> — Set the REVOKED bit on a DNSSEC key</p>
64185f9824e42f21ca7b9ae6c004484215c031a7rbb<div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code> [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
64185f9824e42f21ca7b9ae6c004484215c031a7rbb<p><span><strong class="command">dnssec-revoke</strong></span>
64185f9824e42f21ca7b9ae6c004484215c031a7rbb reads a DNSSEC key file, sets the REVOKED bit on the key as defined
6ca0e6973c8176100f4a426444823ae5e777e28fsascha in RFC 5011, and creates a new pair of key files containing the
6ca0e6973c8176100f4a426444823ae5e777e28fsascha now-revoked key.
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha Emit usage message and exit.
b3aeccd394a91bef671438fa47b9ccd7cd6145a5sascha<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
b3aeccd394a91bef671438fa47b9ccd7cd6145a5sascha Sets the directory in which the key files are to reside.
2795c373a9fb112dc77576c1dfc23119f02d598amanoj After writing the new keyset files remove the original keyset
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha Sets the debugging level.
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha Use the given OpenSSL engine. When compiled with PKCS#11 support
b3aeccd394a91bef671438fa47b9ccd7cd6145a5sascha it defaults to pkcs11; the empty name resets it to no engine.
b3aeccd394a91bef671438fa47b9ccd7cd6145a5sascha Force overwrite: Causes <span><strong class="command">dnssec-revoke</strong></span> to
b3aeccd394a91bef671438fa47b9ccd7cd6145a5sascha write the new key pair even if a file already exists matching
b3aeccd394a91bef671438fa47b9ccd7cd6145a5sascha the algorithm and key ID of the revoked key.
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha Print the key tag of the key with the REVOKE bit set but do
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha not revoke the key.
6ca0e6973c8176100f4a426444823ae5e777e28fsascha<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
96e6cafca226a8a2a64a7bbdc634b5b2679c9e0csascha<p><span class="corpauthor">Internet Systems Consortium</span>