man.dnssec-settime.html revision d6fa26d0adaec6c910115be34fe7a5a5f402c14f
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - Copyright (C) 2000-2015 Internet Systems Consortium, Inc. ("ISC")
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews - file, You can obtain one at http://mozilla.org/MPL/2.0/.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<table width="100%" summary="Navigation header">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<th width="60%" align="center">Manual pages</th>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<a name="man.dnssec-settime"></a><div class="titlepage"></div>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<p><span class="application">dnssec-settime</span> — set the key timing metadata for a DNSSEC key</p>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<p><span class="command"><strong>dnssec-settime</strong></span>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews reads a DNSSEC private key file and sets the key timing metadata
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews options. The metadata can then be used by
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <span class="command"><strong>dnssec-signzone</strong></span> or other signing software to
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews determine when a key is to be published, whether it should be
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews used for signing a zone, etc.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews If none of these options is set on the command line,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews then <span class="command"><strong>dnssec-settime</strong></span> simply prints the key timing
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews metadata already stored in the key.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews When key metadata fields are changed, both files of a key
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Metadata fields are stored in the private file. A human-readable
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews description of the metadata is also placed in comments in the key
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews file. The private file's permissions are always set to be
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews inaccessible to anyone other than the owner (mode 0600).
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<div class="variablelist"><dl class="variablelist">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Force an update of an old-format key with no metadata fields.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Without this option, <span class="command"><strong>dnssec-settime</strong></span> will
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews fail when attempting to update a legacy key. With this option,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews the key will be recreated in the new format, but with the
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews original key data retained. The key's creation date will be
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews set to the present time. If no other values are specified,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews then the key's publication and activation dates will also
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews be set to the present time.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the directory in which the key files are to reside.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the default TTL to use for this key when it is converted
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews into a DNSKEY RR. If the key is imported into a zone,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews this is the TTL that will be used for it, unless there was
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews already a DNSKEY RRset in place, in which case the existing TTL
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews would take precedence. If this value is not set and there
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews is no existing DNSKEY RRset, the TTL will default to the
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews SOA TTL. Setting the default TTL to <code class="literal">0</code>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews or <code class="literal">none</code> removes it from the key.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Emit usage message and exit.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Prints version information.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the debugging level.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Specifies the cryptographic hardware to use, when applicable.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews When BIND is built with OpenSSL PKCS#11 support, this defaults
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews to the string "pkcs11", which identifies an OpenSSL engine
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews that can drive a cryptographic accelerator or hardware service
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews module. When BIND is built with native PKCS#11 cryptography
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews (--enable-native-pkcs11), it defaults to the path of the PKCS#11
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews provider library specified via "--with-pkcs11".
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<a name="id-1.14.15.9"></a><h2>TIMING OPTIONS</h2>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews If the argument begins with a '+' or '-', it is interpreted as
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews an offset from the present time. For convenience, if such an offset
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews then the offset is computed in years (defined as 365 24-hour days,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews ignoring leap years), months (defined as 30 24-hour days), weeks,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews days, hours, or minutes, respectively. Without a suffix, the offset
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews is computed in seconds. To unset a date, use 'none' or 'never'.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<div class="variablelist"><dl class="variablelist">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the date on which a key is to be published to the zone.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews After that date, the key will be included in the zone but will
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews not be used to sign it.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the date on which CDS and CDNSKEY records that match this
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews key are to be published to the zone.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the date on which the key is to be activated. After that
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews date, the key will be included in the zone and used to sign
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the date on which the key is to be revoked. After that
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews date, the key will be flagged as revoked. It will be included
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews in the zone and will be used to sign it.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the date on which the key is to be retired. After that
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews date, the key will still be included in the zone, but it
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews will not be used to sign it.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the date on which the key is to be deleted. After that
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews date, the key will no longer be included in the zone. (It
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews may remain in the key repository, however.)
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the date on which the CDS and CDNSKEY records that match this
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews key are to be deleted.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-S <em class="replaceable"><code>predecessor key</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Select a key for which the key being modified will be an
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews explicit successor. The name, algorithm, size, and type of the
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews predecessor key must exactly match those of the key being
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews modified. The activation date of the successor key will be set
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews to the inactivation date of the predecessor. The publication
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews date will be set to the activation date minus the prepublication
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews interval, which defaults to 30 days.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Sets the prepublication interval for a key. If set, then
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews the publication and activation dates must be separated by at least
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews this much time. If the activation date is specified but the
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews publication date isn't, then the publication date will default
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews to this much time before the activation date; conversely, if
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews the publication date is specified but activation date isn't,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews then activation will be set to this much time after publication.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews If the key is being set to be an explicit successor to another
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews key, then the default prepublication interval is 30 days;
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews otherwise it is zero.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews As with date offsets, if the argument is followed by one of
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews interval is measured in years, months, weeks, days, hours,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews or minutes, respectively. Without a suffix, the interval is
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews measured in seconds.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<a name="id-1.14.15.10"></a><h2>PRINTING OPTIONS</h2>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <span class="command"><strong>dnssec-settime</strong></span> can also be used to print the
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews timing metadata associated with a key.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<div class="variablelist"><dl class="variablelist">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Print times in UNIX epoch format.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<dt><span class="term">-p <em class="replaceable"><code>C/P/Psync/A/R/I/D/Dsync/all</code></em></span></dt>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews Print a specific metadata value or set of metadata values.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews The <code class="option">-p</code> option may be followed by one or more
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews of the following letters or strings to indicate which value
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews or values to print:
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">C</code> for the creation date,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">P</code> for the publication date,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">Psync</code> for the CDS and CDNSKEY publication date,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">A</code> for the activation date,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">R</code> for the revocation date,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">I</code> for the inactivation date,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">D</code> for the deletion date, and
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <code class="option">Dsync</code> for the CDS and CDNSKEY deletion date
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews To print all of the metadata, use <code class="option">-p all</code>.
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<table width="100%" summary="Navigation footer">
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
582f8b9a8d170a80ef67475bddb8ad5cf7cd7cadMark Andrews<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>