man.dnssec-settime.html revision 83f43b00a50c9c932c81691a3828041643a0d6f6
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - Copyright (C) 2000-2003 Internet Software Consortium.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - Permission to use, copy, modify, and/or distribute this software for any
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - purpose with or without fee is hereby granted, provided that the above
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - copyright notice and this permission notice appear in all copies.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch - PERFORMANCE OF THIS SOFTWARE.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<!-- $Id: man.dnssec-settime.html,v 1.39 2010/03/10 01:14:18 tbox Exp $ -->
50ba4fe3a8c79c1f2194d334be6193f9f0863577Timo Sirainen<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
50ba4fe3a8c79c1f2194d334be6193f9f0863577Timo Sirainen<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
50ba4fe3a8c79c1f2194d334be6193f9f0863577Timo Sirainen<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<table width="100%" summary="Navigation header">
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<th width="60%" align="center">Manual pages</th>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<a name="man.dnssec-settime"></a><div class="titlepage"></div>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<p><span class="application">dnssec-settime</span> — Set the key timing metadata for a DNSSEC key</p>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<p><span><strong class="command">dnssec-settime</strong></span>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch reads a DNSSEC private key file and sets the key timing metadata
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch options. The metadata can then be used by
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <span><strong class="command">dnssec-signzone</strong></span> or other signing software to
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch determine when a key is to be published, whether it should be
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch used for signing a zone, etc.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch If none of these options is set on the command line,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch then <span><strong class="command">dnssec-settime</strong></span> simply prints the key timing
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch metadata already stored in the key.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch When key metadata fields are changed, both files of a key
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Metadata fields are stored in the private file. A human-readable
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch description of the metadata is also placed in comments in the key
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Force an update of an old-format key with no metadata fields.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Without this option, <span><strong class="command">dnssec-settime</strong></span> will
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch fail when attempting to update a legacy key. With this option,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch the key will be recreated in the new format, but with the
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch original key data retained. The key's creation date will be
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch set to the present time.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Sets the directory in which the key files are to reside.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Emit usage message and exit.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Sets the debugging level.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Use the given OpenSSL engine. When compiled with PKCS#11 support
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch it defaults to pkcs11; the empty name resets it to no engine.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<a name="id2613902"></a><h2>TIMING OPTIONS</h2>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch If the argument begins with a '+' or '-', it is interpreted as
711e8e4c5c5d702dfa062f42a1ede5de14c151c9Stephan Bosch an offset from the present time. For convenience, if such an offset
711e8e4c5c5d702dfa062f42a1ede5de14c151c9Stephan Bosch is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch then the offset is computed in years (defined as 365 24-hour days,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch ignoring leap years), months (defined as 30 24-hour days), weeks,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch days, hours, or minutes, respectively. Without a suffix, the offset
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch is computed in seconds. To unset a date, use 'none'.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Sets the date on which a key is to be published to the zone.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch After that date, the key will be included in the zone but will
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch not be used to sign it.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Sets the date on which the key is to be activated. After that
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch date, the key will be included in the zone and used to sign
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Sets the date on which the key is to be revoked. After that
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch date, the key will be flagged as revoked. It will be included
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch in the zone and will be used to sign it.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Sets the date on which the key is to be retired. After that
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch date, the key will still be included in the zone, but it
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch will not be used to sign it.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Sets the date on which the key is to be deleted. After that
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch date, the key will no longer be included in the zone. (It
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch may remain in the key repository, however.)
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<a name="id2614001"></a><h2>PRINTING OPTIONS</h2>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch timing metadata associated with a key.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Print times in UNIX epoch format.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/I/D/all</code></em></span></dt>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch Print a specific metadata value or set of metadata values.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch The <code class="option">-p</code> option may be followed by one or more
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch of the following letters to indicate which value or values to print:
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <code class="option">C</code> for the creation date,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <code class="option">P</code> for the publication date,
50ba4fe3a8c79c1f2194d334be6193f9f0863577Timo Sirainen <code class="option">A</code> for the activation date,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <code class="option">R</code> for the revocation date,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <code class="option">I</code> for the inactivation date, or
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <code class="option">D</code> for the deletion date.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch To print all of the metadata, use <code class="option">-p all</code>.
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<p><span class="corpauthor">Internet Systems Consortium</span>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<table width="100%" summary="Navigation footer">
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<span class="application">dnssec-revoke</span>�</td>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
3fcb3d2d1f3583025ff62bae95ec706920f398b1Stephan Bosch<td width="40%" align="right" valign="top">�<span class="application">dnssec-signzone</span>