man.dnssec-settime.html revision d9c707589ade5d69fb59b6837555adc4cd24d34f
0d26a2bd71224b954baab529bbadc4d676c35b95slive - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
e942c741056732f50da2074b36fe59805d370650slive - Copyright (C) 2000-2003 Internet Software Consortium.
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - Permission to use, copy, modify, and/or distribute this software for any
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - purpose with or without fee is hereby granted, provided that the above
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - copyright notice and this permission notice appear in all copies.
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd - PERFORMANCE OF THIS SOFTWARE.
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd<!-- $Id: man.dnssec-settime.html,v 1.67 2011/05/09 01:14:45 tbox Exp $ -->
d5d794fc2f4cc9ca6d6da17cfa2cdcd8d244bacdnd<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
6eef889fc0b7cd42c4c8ca7e8e094dc2c0b030fcslive<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
e0cbf588b6280e9857b9d8756077d513e13a12b3slive<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
6eef889fc0b7cd42c4c8ca7e8e094dc2c0b030fcslive<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
f9f056cc901d76ce30456457a4f15fec1a42e8a7rbowen<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<a name="man.dnssec-settime"></a><div class="titlepage"></div>
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<p><span class="application">dnssec-settime</span> — Set the key timing metadata for a DNSSEC key</p>
d5d6e50ca44fba6138129059cc6ad3e544da31cfslive<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<p><span><strong class="command">dnssec-settime</strong></span>
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen reads a DNSSEC private key file and sets the key timing metadata
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen options. The metadata can then be used by
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen <span><strong class="command">dnssec-signzone</strong></span> or other signing software to
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen determine when a key is to be published, whether it should be
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen used for signing a zone, etc.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen If none of these options is set on the command line,
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen then <span><strong class="command">dnssec-settime</strong></span> simply prints the key timing
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen metadata already stored in the key.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen When key metadata fields are changed, both files of a key
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen Metadata fields are stored in the private file. A human-readable
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen description of the metadata is also placed in comments in the key
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen Force an update of an old-format key with no metadata fields.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen Without this option, <span><strong class="command">dnssec-settime</strong></span> will
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen fail when attempting to update a legacy key. With this option,
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen the key will be recreated in the new format, but with the
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen original key data retained. The key's creation date will be
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen set to the present time. If no other values are specified,
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen then the key's publication and activation dates will also
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen be set to the present time.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen Sets the directory in which the key files are to reside.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen Sets the default TTL to use for this key when it is converted
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen into a DNSKEY RR. If the key is imported into a zone,
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen this is the TTL that will be used for it, unless there was
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen already a DNSKEY RRset in place, in which case the existing TTL
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen would take precedence. Setting the default TTL to
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen <code class="literal">0</code> or <code class="literal">none</code> removes it.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen Emit usage message and exit.
6eef889fc0b7cd42c4c8ca7e8e094dc2c0b030fcslive<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
6eef889fc0b7cd42c4c8ca7e8e094dc2c0b030fcslive Sets the debugging level.
6eef889fc0b7cd42c4c8ca7e8e094dc2c0b030fcslive<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
ab860363d571038eaf04153967ce68ea11f27e22slive Use the given OpenSSL engine. When compiled with PKCS#11 support
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen it defaults to pkcs11; the empty name resets it to no engine.
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen If the argument begins with a '+' or '-', it is interpreted as
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen an offset from the present time. For convenience, if such an offset
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen then the offset is computed in years (defined as 365 24-hour days,
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen ignoring leap years), months (defined as 30 24-hour days), weeks,
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen days, hours, or minutes, respectively. Without a suffix, the offset
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen is computed in seconds. To unset a date, use 'none'.
936378e1f47e35c9fa44915ea4d2e39cbdd52fe7rbowen<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
e06675c51d084791089d79c3ac18aeae8dd465fcrbb Sets the date on which a key is to be published to the zone.
e06675c51d084791089d79c3ac18aeae8dd465fcrbb After that date, the key will be included in the zone but will
e06675c51d084791089d79c3ac18aeae8dd465fcrbb not be used to sign it.
e06675c51d084791089d79c3ac18aeae8dd465fcrbb<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
e06675c51d084791089d79c3ac18aeae8dd465fcrbb Sets the date on which the key is to be activated. After that
e06675c51d084791089d79c3ac18aeae8dd465fcrbb date, the key will be included in the zone and used to sign
e06675c51d084791089d79c3ac18aeae8dd465fcrbb<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
e06675c51d084791089d79c3ac18aeae8dd465fcrbb Sets the date on which the key is to be revoked. After that
e06675c51d084791089d79c3ac18aeae8dd465fcrbb date, the key will be flagged as revoked. It will be included
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen in the zone and will be used to sign it.
f9f056cc901d76ce30456457a4f15fec1a42e8a7rbowen<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
f9f056cc901d76ce30456457a4f15fec1a42e8a7rbowen Sets the date on which the key is to be retired. After that
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen date, the key will still be included in the zone, but it
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen will not be used to sign it.
e213c78d4d5c360645156dab56938b3565ebe8c1rbowen<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>