man.dnssec-settime.html revision 8ec3c085233cedb22b05da36e2773c8f357a7e45
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - Copyright (C) 2000-2003 Internet Software Consortium.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - Permission to use, copy, modify, and/or distribute this software for any
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - purpose with or without fee is hereby granted, provided that the above
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - copyright notice and this permission notice appear in all copies.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle - PERFORMANCE OF THIS SOFTWARE.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<!-- $Id: man.dnssec-settime.html,v 1.11 2009/10/06 01:14:41 tbox Exp $ -->
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
37c999796383567df3db1f9d2a09942d83d413caChad Kienle<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<a name="man.dnssec-settime"></a><div class="titlepage"></div>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<p><span class="application">dnssec-settime</span> — Set the key timing metadata for a DNSSEC key</p>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<p><span><strong class="command">dnssec-settime</strong></span>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle reads a DNSSEC private key file and sets the key timing metadata
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle options. The metadata can then be used by
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <span><strong class="command">dnssec-signzone</strong></span> or other signing software to
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle determine when a key is to be published, whether it should be
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle used for signing a zone, etc.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle If none of these options is set on the command line,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle then <span><strong class="command">dnssec-settime</strong></span> simply prints the key timing
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle metadata already stored in the key.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle When key metadata fields are changed, both files of a key
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Metadata fields are stored in the private file. A human-readable
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle description of the metadata is also placed in comments in the key
37c999796383567df3db1f9d2a09942d83d413caChad Kienle Force an update of an old-format key with no metadata fields.
37c999796383567df3db1f9d2a09942d83d413caChad Kienle Without this option, <span><strong class="command">dnssec-settime</strong></span> will
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle fail when attempting to update a legacy key. With this option,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle the key will be recreated in the new format, but with the
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle original key data retained. The key's creation date will be
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle set to the present time.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Sets the directory in which the key files are to reside.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Emit usage message and exit.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Sets the debugging level.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Use the given OpenSSL engine. When compiled with PKCS#11 support
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle it defaults to pcks11, the empty name resets it to no engine.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle If the argument begins with a '+' or '-', it is interpreted as
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle an offset from the present time. For convenience, if such an offset
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle then the offset is computed in years (defined as 365 24-hour days,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle ignoring leap years), months (defined as 30 24-hour days), weeks,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle days, hours, or minutes, respectively. Without a suffix, the offset
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle is computed in seconds. To unset a date, use 'none'.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Sets the date on which a key is to be published to the zone.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle After that date, the key will be included in the zone but will
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle not be used to sign it.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Sets the date on which the key is to be activated. After that
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle date, the key will be included and the zone and used to sign
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Sets the date on which the key is to be revoked. After that
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle date, the key will be flagged as revoked. It will be included
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle in the zone and will be used to sign it.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Sets the date on which the key is to be retired. After that
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle date, the key will still be included in the zone, but it
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle will not be used to sign it.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Sets the date on which the key is to be deleted. After that
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle date, the key will no longer be included in the zone. (It
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle may remain in the key repository, however.)
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<a name="id2610008"></a><h2>PRINTING OPTIONS</h2>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle timing metadata associated with a key.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Print times in UNIX epoch format.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/U/D/all</code></em></span></dt>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle Print a specific metadata value or set of metadata values.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle The <code class="option">-p</code> option may be followed by one or more
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle of the following letters to indicate which value or values to print:
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="option">C</code> for the creation date,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="option">P</code> for the publication date,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="option">A</code> for the activation date,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="option">R</code> for the revokation date,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="option">U</code> for the unpublication date, or
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <code class="option">D</code> for the deletion date.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle To print all of the metadata, use <code class="option">-p all</code>.
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<p><span class="corpauthor">Internet Systems Consortium</span>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<span class="application">dnssec-revoke</span>�</td>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
37f9df7d5b474a12668813f98992dceb7c7feacbChad Kienle<td width="40%" align="right" valign="top">�<span class="application">dnssec-signzone</span>