man.dnssec-settime.html revision a87790b9d8e062fac1b2dfb8903e77bfe92a3891
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - Copyright (C) 2000-2003 Internet Software Consortium.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - Permission to use, copy, modify, and/or distribute this software for any
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - purpose with or without fee is hereby granted, provided that the above
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - copyright notice and this permission notice appear in all copies.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync - PERFORMANCE OF THIS SOFTWARE.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<!-- $Id$ -->
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<a name="man.dnssec-settime"></a><div class="titlepage"></div>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<p><span class="application">dnssec-settime</span> — Set the key timing metadata for a DNSSEC key</p>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<p><span><strong class="command">dnssec-settime</strong></span>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync reads a DNSSEC private key file and sets the key timing metadata
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
62989a9da77b2beadc7d3c9db616d3cc12f97a0evboxsync options. The metadata can then be used by
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync <span><strong class="command">dnssec-signzone</strong></span> or other signing software to
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync determine when a key is to be published, whether it should be
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync used for signing a zone, etc.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync If none of these options is set on the command line,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync then <span><strong class="command">dnssec-settime</strong></span> simply prints the key timing
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync metadata already stored in the key.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync When key metadata fields are changed, both files of a key
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Metadata fields are stored in the private file. A human-readable
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync description of the metadata is also placed in comments in the key
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync file. The private file's permissions are always set to be
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync inaccessible to anyone other than the owner (mode 0600).
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Force an update of an old-format key with no metadata fields.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Without this option, <span><strong class="command">dnssec-settime</strong></span> will
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync fail when attempting to update a legacy key. With this option,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync the key will be recreated in the new format, but with the
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync original key data retained. The key's creation date will be
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync set to the present time. If no other values are specified,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync then the key's publication and activation dates will also
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync be set to the present time.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Sets the directory in which the key files are to reside.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Sets the default TTL to use for this key when it is converted
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync into a DNSKEY RR. If the key is imported into a zone,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync this is the TTL that will be used for it, unless there was
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync already a DNSKEY RRset in place, in which case the existing TTL
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync would take precedence. Setting the default TTL to
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync <code class="literal">0</code> or <code class="literal">none</code> removes it.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Emit usage message and exit.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Sets the debugging level.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Specifies the cryptographic hardware to use, when applicable.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync When BIND is built with OpenSSL PKCS#11 support, this defaults
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync to the string "pkcs11", which identifies an OpenSSL engine
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync that can drive a cryptographic accelerator or hardware service
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync module. When BIND is built with native PKCS#11 cryptography
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync (--enable-native-pkcs11), it defaults to the path of the PKCS#11
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync provider library specified via "--with-pkcs11".
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync If the argument begins with a '+' or '-', it is interpreted as
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync an offset from the present time. For convenience, if such an offset
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync then the offset is computed in years (defined as 365 24-hour days,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync ignoring leap years), months (defined as 30 24-hour days), weeks,
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync days, hours, or minutes, respectively. Without a suffix, the offset
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync is computed in seconds. To unset a date, use 'none' or 'never'.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Sets the date on which a key is to be published to the zone.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync After that date, the key will be included in the zone but will
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync not be used to sign it.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Sets the date on which the key is to be activated. After that
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync date, the key will be included in the zone and used to sign
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync Sets the date on which the key is to be revoked. After that
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync date, the key will be flagged as revoked. It will be included
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync in the zone and will be used to sign it.
a734c64bff58bda2fa48c2795453e092167b0ff7vboxsync<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>