man.dnssec-settime.html revision 77dccf2a5d9327d16b4374a135cdb99bdd48620e
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - Copyright (C) 2000-2003 Internet Software Consortium.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - Permission to use, copy, modify, and/or distribute this software for any
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - purpose with or without fee is hereby granted, provided that the above
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - copyright notice and this permission notice appear in all copies.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering - PERFORMANCE OF THIS SOFTWARE.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<!-- $Id: man.dnssec-settime.html,v 1.84 2011/11/05 01:14:49 tbox Exp $ -->
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
8bdbb8d9cbe1d35708385573d70984ab4533812dLennart Poettering<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
878cd7e95ca303f9851d227a22d2022bd49944b0Lennart Poettering<table width="100%" summary="Navigation header">
878cd7e95ca303f9851d227a22d2022bd49944b0Lennart Poettering<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
f2cbe59e113f08549949a76ac5b9b3972df4cc30Lennart Poettering<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
d538bfc71331d2e48363283decd77a61599021dbCristian Rodríguez<th width="60%" align="center">Manual pages</th>
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen<a name="man.dnssec-settime"></a><div class="titlepage"></div>
aa1936ea1a89c2bb968ba33e3274898a4eeae771Lennart Poettering<p><span class="application">dnssec-settime</span> — Set the key timing metadata for a DNSSEC key</p>
04d39279245834494baccfdb9349db8bf80abd13Lennart Poettering<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
785890acf6d629ff881a1f065f431df1b7fc8c7aLennart Poettering<a name="id2616810"></a><h2>DESCRIPTION</h2>
f2cbe59e113f08549949a76ac5b9b3972df4cc30Lennart Poettering<p><span><strong class="command">dnssec-settime</strong></span>
56159e0d918e9a9be07988133bb2847779325de0Lennart Poettering reads a DNSSEC private key file and sets the key timing metadata
3d7415f43f0fe6a821d7bc4a341ba371e8a30ef3Lennart Poettering as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering options. The metadata can then be used by
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering <span><strong class="command">dnssec-signzone</strong></span> or other signing software to
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering determine when a key is to be published, whether it should be
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering used for signing a zone, etc.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering If none of these options is set on the command line,
d21ed1ead18d16d35c30299a69d3366847f8a039Lennart Poettering then <span><strong class="command">dnssec-settime</strong></span> simply prints the key timing
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering metadata already stored in the key.
d8f52ed25a9edce75fda5251c977b7898e33887eLennart Poettering When key metadata fields are changed, both files of a key
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering Metadata fields are stored in the private file. A human-readable
3d7415f43f0fe6a821d7bc4a341ba371e8a30ef3Lennart Poettering description of the metadata is also placed in comments in the key
3d7415f43f0fe6a821d7bc4a341ba371e8a30ef3Lennart Poettering file. The private file's permissions are always set to be
3d7415f43f0fe6a821d7bc4a341ba371e8a30ef3Lennart Poettering inaccessible to anyone other than the owner (mode 0600).
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering Force an update of an old-format key with no metadata fields.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering Without this option, <span><strong class="command">dnssec-settime</strong></span> will
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering fail when attempting to update a legacy key. With this option,
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering the key will be recreated in the new format, but with the
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering original key data retained. The key's creation date will be
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering set to the present time. If no other values are specified,
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering then the key's publication and activation dates will also
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering be set to the present time.
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering Sets the directory in which the key files are to reside.
acf97e213e69a97e63ab8f7fad7ecd53608c757aLennart Poettering<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering Sets the default TTL to use for this key when it is converted
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering into a DNSKEY RR. If the key is imported into a zone,
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering this is the TTL that will be used for it, unless there was
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering already a DNSKEY RRset in place, in which case the existing TTL
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering would take precedence. Setting the default TTL to
8b0cc9a36c8f92f010f2e8465942d2cd7c580d78Lennart Poettering <code class="literal">0</code> or <code class="literal">none</code> removes it.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering Emit usage message and exit.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering Sets the debugging level.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering Use the given OpenSSL engine. When compiled with PKCS#11 support
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering it defaults to pkcs11; the empty name resets it to no engine.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering<a name="id2616990"></a><h2>TIMING OPTIONS</h2>
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering If the argument begins with a '+' or '-', it is interpreted as
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen an offset from the present time. For convenience, if such an offset
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
56159e0d918e9a9be07988133bb2847779325de0Lennart Poettering then the offset is computed in years (defined as 365 24-hour days,
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering ignoring leap years), months (defined as 30 24-hour days), weeks,
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering days, hours, or minutes, respectively. Without a suffix, the offset
56159e0d918e9a9be07988133bb2847779325de0Lennart Poettering is computed in seconds. To unset a date, use 'none'.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen Sets the date on which a key is to be published to the zone.
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen After that date, the key will be included in the zone but will
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen not be used to sign it.
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen Sets the date on which the key is to be activated. After that
3d7415f43f0fe6a821d7bc4a341ba371e8a30ef3Lennart Poettering date, the key will be included in the zone and used to sign
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering Sets the date on which the key is to be revoked. After that
3d7415f43f0fe6a821d7bc4a341ba371e8a30ef3Lennart Poettering date, the key will be flagged as revoked. It will be included
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen in the zone and will be used to sign it.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering Sets the date on which the key is to be retired. After that
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering date, the key will still be included in the zone, but it
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering will not be used to sign it.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering Sets the date on which the key is to be deleted. After that
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering date, the key will no longer be included in the zone. (It
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering may remain in the key repository, however.)
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering<dt><span class="term">-S <em class="replaceable"><code>predecessor key</code></em></span></dt>
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering Select a key for which the key being modified will be an
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering explicit successor. The name, algorithm, size, and type of the
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering predecessor key must exactly match those of the key being
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering modified. The activation date of the successor key will be set
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering to the inactivation date of the predecessor. The publication
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering date will be set to the activation date minus the prepublication
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering interval, which defaults to 30 days.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen Sets the prepublication interval for a key. If set, then
5b30bef856e89a571df57b7b953e9a1409d9acedLennart Poettering the publication and activation dates must be separated by at least
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen this much time. If the activation date is specified but the
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen publication date isn't, then the publication date will default
a1da85830bfaa77b9eb9c54693e5573559c97e50Tom Gundersen to this much time before the activation date; conversely, if
5b30bef856e89a571df57b7b953e9a1409d9acedLennart Poettering the publication date is specified but activation date isn't,
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering then activation will be set to this much time after publication.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering If the key is being set to be an explicit successor to another
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering key, then the default prepublication interval is 30 days;
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering otherwise it is zero.
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering As with date offsets, if the argument is followed by one of
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering interval is measured in years, months, weeks, days, hours,
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering or minutes, respectively. Without a suffix, the interval is
0b63e2789f984e84f40bf6e49f5da15c87298cedLennart Poettering measured in seconds.
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering<a name="id2617470"></a><h2>PRINTING OPTIONS</h2>
1ee306e1248866617c96ed9f4263f375588ad838Lennart Poettering <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering timing metadata associated with a key.
10f9c75519671e7c7ab8993b54fe22da7c2d0c38Lennart Poettering Print times in UNIX epoch format.
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/I/D/all</code></em></span></dt>
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering Print a specific metadata value or set of metadata values.
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering The <code class="option">-p</code> option may be followed by one or more
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering of the following letters to indicate which value or values to print:
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering <code class="option">C</code> for the creation date,
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering <code class="option">P</code> for the publication date,
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering <code class="option">A</code> for the activation date,
56159e0d918e9a9be07988133bb2847779325de0Lennart Poettering <code class="option">R</code> for the revocation date,
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering <code class="option">I</code> for the inactivation date, or
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering <code class="option">D</code> for the deletion date.
c19de71113f956809995fc68817e055e9f61f607Lennart Poettering To print all of the metadata, use <code class="option">-p all</code>.
b6b1849830f5e4a6065c3b0c993668e500c954d3Lennart Poettering<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
10f9c75519671e7c7ab8993b54fe22da7c2d0c38Lennart Poettering <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<p><span class="corpauthor">Internet Systems Consortium</span>
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<table width="100%" summary="Navigation footer">
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<td width="40%" align="left" valign="top">
cd61c3bfd718fb398cc53ced906266a9297782c9Lennart Poettering<span class="application">dnssec-revoke</span>�</td>
b6b1849830f5e4a6065c3b0c993668e500c954d3Lennart Poettering<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
b6b1849830f5e4a6065c3b0c993668e500c954d3Lennart Poettering<td width="40%" align="right" valign="top">�<span class="application">dnssec-signzone</span>