man.dnssec-settime.html revision 7a0d680aa507f1b9beaa5c350e4d562aab534323
bec154197d3d640b0d5b416cd5218ea58dca5d3aTinderbox User - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and/or distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
ea94d370123a5892f6c47a97f21d1b28d44bb168Tinderbox User<!-- $Id: man.dnssec-settime.html,v 1.31 2009/12/19 01:14:05 tbox Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="man.dnssec-settime"></a><div class="titlepage"></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="application">dnssec-settime</span> — Set the key timing metadata for a DNSSEC key</p>
bec154197d3d640b0d5b416cd5218ea58dca5d3aTinderbox User<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
bec154197d3d640b0d5b416cd5218ea58dca5d3aTinderbox User<p><span><strong class="command">dnssec-settime</strong></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein reads a DNSSEC private key file and sets the key timing metadata
bec154197d3d640b0d5b416cd5218ea58dca5d3aTinderbox User as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
0ccb0e98c77a9b9636a036f8f64f5679a430aaf4Tinderbox User <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein options. The metadata can then be used by
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">dnssec-signzone</strong></span> or other signing software to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein determine when a key is to be published, whether it should be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein used for signing a zone, etc.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews If none of these options is set on the command line,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein then <span><strong class="command">dnssec-settime</strong></span> simply prints the key timing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein metadata already stored in the key.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein When key metadata fields are changed, both files of a key
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
bec154197d3d640b0d5b416cd5218ea58dca5d3aTinderbox User <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Metadata fields are stored in the private file. A human-readable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein description of the metadata is also placed in comments in the key
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Force an update of an old-format key with no metadata fields.
727f5b8846457a33d06f515a10a7e1aa849ddf18Andreas Gustafsson Without this option, <span><strong class="command">dnssec-settime</strong></span> will
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce fail when attempting to update a legacy key. With this option,
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater the key will be recreated in the new format, but with the
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater original key data retained. The key's creation date will be
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater set to the present time.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater Sets the directory in which the key files are to reside.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Emit usage message and exit.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the debugging level.
bec154197d3d640b0d5b416cd5218ea58dca5d3aTinderbox User<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Use the given OpenSSL engine. When compiled with PKCS#11 support
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it defaults to pkcs11; the empty name resets it to no engine.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater<a name="id2610638"></a><h2>TIMING OPTIONS</h2>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater If the argument begins with a '+' or '-', it is interpreted as
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater an offset from the present time. For convenience, if such an offset
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater then the offset is computed in years (defined as 365 24-hour days,
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater ignoring leap years), months (defined as 30 24-hour days), weeks,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce days, hours, or minutes, respectively. Without a suffix, the offset
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce is computed in seconds. To unset a date, use 'none'.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Sets the date on which a key is to be published to the zone.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce After that date, the key will be included in the zone but will
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce not be used to sign it.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Sets the date on which the key is to be activated. After that
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater date, the key will be included in the zone and used to sign
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Sets the date on which the key is to be revoked. After that
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce date, the key will be flagged as revoked. It will be included
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce in the zone and will be used to sign it.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce Sets the date on which the key is to be retired. After that
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce date, the key will still be included in the zone, but it
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce will not be used to sign it.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Sets the date on which the key is to be deleted. After that
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein date, the key will no longer be included in the zone. (It
bec154197d3d640b0d5b416cd5218ea58dca5d3aTinderbox User may remain in the key repository, however.)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2610737"></a><h2>PRINTING OPTIONS</h2>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein timing metadata associated with a key.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Print times in UNIX epoch format.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/U/D/all</code></em></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Print a specific metadata value or set of metadata values.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <code class="option">-p</code> option may be followed by one or more
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of the following letters to indicate which value or values to print:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">C</code> for the creation date,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">P</code> for the publication date,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">A</code> for the activation date,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">R</code> for the revokation date,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">U</code> for the unpublication date, or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="option">D</code> for the deletion date.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To print all of the metadata, use <code class="option">-p all</code>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<p><span class="corpauthor">Internet Systems Consortium</span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<span class="application">dnssec-revoke</span>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�<span class="application">dnssec-signzone</span>