man.dnssec-settime.html revision de283bda6a902c2102a795192eeab3a769001c7d
a096f8d13bee05fd6ea8b9b50b6c2e818eace7d1striker - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj - Copyright (C) 2000-2003 Internet Software Consortium.
2a6c49cfaef5979a5a06098f3ce987cd76769409manoj - Permission to use, copy, modify, and/or distribute this software for any
eb1349e4ab58bd2935f7054a1bfc5c86ab5a5fa3striker - purpose with or without fee is hereby granted, provided that the above
a096f8d13bee05fd6ea8b9b50b6c2e818eace7d1striker - copyright notice and this permission notice appear in all copies.
dba571e5c5a2586c7e2b382789f3250136ff7577jwoolley - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
bf3d1782a29630335a1df535eb395355ab1cd154jwoolley - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
07847078a10fe4e9229cc08adda5f421cafc0665jwoolley - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
0bd0176ce9f4321eeb506aa372d0bcc84befbf4cstriker - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
d8028365066fca602bf35d014530a1802114378crbb - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
c25203fdca093d4504c51b4cd974ff60d5aa4fb1wrowe - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
c25203fdca093d4504c51b4cd974ff60d5aa4fb1wrowe - PERFORMANCE OF THIS SOFTWARE.
d89c116f82699294ca744125723651c554bc5925wrowe<!-- $Id$ -->
c25203fdca093d4504c51b4cd974ff60d5aa4fb1wrowe<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
91cacb801f6c0215b38322f6d2fc58cbfedfecfbjerenkrantz<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
df14f0d3a5191cdd7c4bb5b03acd135d43a6f51brbb<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
df14f0d3a5191cdd7c4bb5b03acd135d43a6f51brbb<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
ab71b233b3a36489e44a7b061c48293be0b17788jwoolley<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
571760de5e60c0b459cb11be45507b923cd023eejwoolley<link rel="next" href="man.dnssec-signzone.html" title="dnssec-signzone">
9180a5933673ffb1af633c255ceee029340f3b1erbb<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
2900ab946a2d76b73a14cebfe2985d253f01c967stoddard<tr><th colspan="3" align="center"><span class="application">dnssec-settime</span></th></tr>
a548c09e6a8ca1b059d0e93b5256c6ccb2b3c3cdrbb<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
cf6bf6c34c936e6a6fe731dbce4a5c3c8bf8e9a3gstein<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
70f6f32765cfaadd6da8de6f0fea97ddd72d8fadmanoj<a name="man.dnssec-settime"></a><div class="titlepage"></div>
af4c982a7cf4515f124935f99a329744035fc699slive<p><span class="application">dnssec-settime</span> — Set the key timing metadata for a DNSSEC key</p>
af4c982a7cf4515f124935f99a329744035fc699slive<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code> [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
5ca8e11fadb6f7a8d9d0367c1800205c99d4bcd6jerenkrantz<p><span><strong class="command">dnssec-settime</strong></span>
5ca8e11fadb6f7a8d9d0367c1800205c99d4bcd6jerenkrantz reads a DNSSEC private key file and sets the key timing metadata
45b0e1c775c1cfed6473c9e5304179ccb9609f53stoddard as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
dbec4658981e4f9127e8676457c28d42932be7cdtrawick <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
1b7e9aeb9867a1c94e24e8ae491d2dfcd0d225e3jerenkrantz options. The metadata can then be used by
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz <span><strong class="command">dnssec-signzone</strong></span> or other signing software to
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz determine when a key is to be published, whether it should be
f95a0b59eb24c631f15bd83e20c6cf823c432d83trawick used for signing a zone, etc.
f95a0b59eb24c631f15bd83e20c6cf823c432d83trawick If none of these options is set on the command line,
ae72c92fd41562d7c0e8627c093fcbbae4ac9ef2coar then <span><strong class="command">dnssec-settime</strong></span> simply prints the key timing
f95a0b59eb24c631f15bd83e20c6cf823c432d83trawick metadata already stored in the key.
cc22a72861c58dda7f3768613aec864e4c4e0353striker When key metadata fields are changed, both files of a key
f95a0b59eb24c631f15bd83e20c6cf823c432d83trawick pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
ddafc111b94558ef4e2d7357ceda623315566ce3slive <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
ddafc111b94558ef4e2d7357ceda623315566ce3slive Metadata fields are stored in the private file. A human-readable
ae72c92fd41562d7c0e8627c093fcbbae4ac9ef2coar description of the metadata is also placed in comments in the key
ddafc111b94558ef4e2d7357ceda623315566ce3slive file. The private file's permissions are always set to be
93f189f1198f539d3cfa75a15b23dcde60ee35ffrbb inaccessible to anyone other than the owner (mode 0600).
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz Force an update of an old-format key with no metadata fields.
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz Without this option, <span><strong class="command">dnssec-settime</strong></span> will
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz fail when attempting to update a legacy key. With this option,
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe the key will be recreated in the new format, but with the
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz original key data retained. The key's creation date will be
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz set to the present time. If no other values are specified,
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz then the key's publication and activation dates will also
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz be set to the present time.
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz Sets the directory in which the key files are to reside.
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz Sets the default TTL to use for this key when it is converted
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe into a DNSKEY RR. If the key is imported into a zone,
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz this is the TTL that will be used for it, unless there was
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz already a DNSKEY RRset in place, in which case the existing TTL
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz would take precedence. If this value is not set and there
f4cb04eb78da02a38fcdd87489dc7b660107d55fjerenkrantz is no existing DNSKEY RRset, the TTL will default to the
cc22a72861c58dda7f3768613aec864e4c4e0353striker SOA TTL. Setting the default TTL to <code class="literal">0</code>
1af5c0e25a649bb298e25ddfa5418fa18bdcb107aaron or <code class="literal">none</code> removes it from the key.
1b3f48fd6b1ccb8745f908e40156c5a85ca3c347jerenkrantz Emit usage message and exit.
6362fd5c48f6b2193f5d356a9747172101b24e91jerenkrantz Prints version information.
ae72c92fd41562d7c0e8627c093fcbbae4ac9ef2coar<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
6362fd5c48f6b2193f5d356a9747172101b24e91jerenkrantz Sets the debugging level.
630f5fc1277582643fe0f831a4830e15127bd047jwoolley<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
56b2562cb4041a21bc313fde3204beabdb758800jwoolley Specifies the cryptographic hardware to use, when applicable.
56b2562cb4041a21bc313fde3204beabdb758800jwoolley When BIND is built with OpenSSL PKCS#11 support, this defaults
56b2562cb4041a21bc313fde3204beabdb758800jwoolley to the string "pkcs11", which identifies an OpenSSL engine
56b2562cb4041a21bc313fde3204beabdb758800jwoolley that can drive a cryptographic accelerator or hardware service
56b2562cb4041a21bc313fde3204beabdb758800jwoolley module. When BIND is built with native PKCS#11 cryptography
f881b8be216de36c6b964324c772450bca38a4e6trawick (--enable-native-pkcs11), it defaults to the path of the PKCS#11
f881b8be216de36c6b964324c772450bca38a4e6trawick provider library specified via "--with-pkcs11".
b05930e6008f69bd323abe0c10f81f40ffd27983brianp Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
b05930e6008f69bd323abe0c10f81f40ffd27983brianp If the argument begins with a '+' or '-', it is interpreted as
b05930e6008f69bd323abe0c10f81f40ffd27983brianp an offset from the present time. For convenience, if such an offset
15304e476fb32988bf988864ddacc5375b9a6080stoddard is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
15304e476fb32988bf988864ddacc5375b9a6080stoddard then the offset is computed in years (defined as 365 24-hour days,
8c8fbb8546af54582539898be704411a60058d85trawick ignoring leap years), months (defined as 30 24-hour days), weeks,
4c7dab038d90d7feb67ef8ddbfacc77be8c9dbf0jwoolley days, hours, or minutes, respectively. Without a suffix, the offset
4c7dab038d90d7feb67ef8ddbfacc77be8c9dbf0jwoolley is computed in seconds. To unset a date, use 'none' or 'never'.
bb2a72a6e2327ae4f177c9d26e9d433033cfc27eaaron<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
8c8fbb8546af54582539898be704411a60058d85trawick Sets the date on which a key is to be published to the zone.
8c8fbb8546af54582539898be704411a60058d85trawick After that date, the key will be included in the zone but will
f9b8e29cfca92cf0a996e8ab17fa1a1f447cecc7stoddard not be used to sign it.
f9b8e29cfca92cf0a996e8ab17fa1a1f447cecc7stoddard<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe Sets the date on which the key is to be activated. After that
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe date, the key will be included in the zone and used to sign
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe Sets the date on which the key is to be revoked. After that
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe date, the key will be flagged as revoked. It will be included
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe in the zone and will be used to sign it.
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe Sets the date on which the key is to be retired. After that
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe date, the key will still be included in the zone, but it
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe will not be used to sign it.
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe Sets the date on which the key is to be deleted. After that
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe date, the key will no longer be included in the zone. (It
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe may remain in the key repository, however.)
2fb49a1d25f38421a68d31b4cbb5d9293fdeafbewrowe<dt><span class="term">-S <em class="replaceable"><code>predecessor key</code></em></span></dt>
638a9edaf48cf003cd40ac25ee8c25f572107414stoddard Select a key for which the key being modified will be an
638a9edaf48cf003cd40ac25ee8c25f572107414stoddard explicit successor. The name, algorithm, size, and type of the
db2d668e6233d8949b35ee7f9f42f444758f9ce9rbb predecessor key must exactly match those of the key being
db2d668e6233d8949b35ee7f9f42f444758f9ce9rbb modified. The activation date of the successor key will be set
db2d668e6233d8949b35ee7f9f42f444758f9ce9rbb to the inactivation date of the predecessor. The publication
db2d668e6233d8949b35ee7f9f42f444758f9ce9rbb date will be set to the activation date minus the prepublication
db2d668e6233d8949b35ee7f9f42f444758f9ce9rbb interval, which defaults to 30 days.
db2d668e6233d8949b35ee7f9f42f444758f9ce9rbb<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
1ea5221b240a8b41a07c6fb04aab5a73adcddabfaaron Sets the prepublication interval for a key. If set, then
1ea5221b240a8b41a07c6fb04aab5a73adcddabfaaron the publication and activation dates must be separated by at least
a12f07383f9c286519fe88f559187148d5bd1c16aaron this much time. If the activation date is specified but the
1ea5221b240a8b41a07c6fb04aab5a73adcddabfaaron publication date isn't, then the publication date will default
1ea5221b240a8b41a07c6fb04aab5a73adcddabfaaron to this much time before the activation date; conversely, if
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz the publication date is specified but activation date isn't,
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz then activation will be set to this much time after publication.
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz If the key is being set to be an explicit successor to another
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz key, then the default prepublication interval is 30 days;
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz otherwise it is zero.
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz As with date offsets, if the argument is followed by one of
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
5d12baef135b5d3cb94745e007a1575398469724jerenkrantz interval is measured in years, months, weeks, days, hours,
b865daaa4ef731a7066ee6d97e2aae36c7743939jerenkrantz or minutes, respectively. Without a suffix, the interval is
b865daaa4ef731a7066ee6d97e2aae36c7743939jerenkrantz measured in seconds.
b865daaa4ef731a7066ee6d97e2aae36c7743939jerenkrantz<a name="id2640228"></a><h2>PRINTING OPTIONS</h2>
b865daaa4ef731a7066ee6d97e2aae36c7743939jerenkrantz <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
b865daaa4ef731a7066ee6d97e2aae36c7743939jerenkrantz timing metadata associated with a key.
b865daaa4ef731a7066ee6d97e2aae36c7743939jerenkrantz Print times in UNIX epoch format.
dc098c7ce5d36179c504d09fc722d190683d0262aaron<dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/I/D/all</code></em></span></dt>
dc098c7ce5d36179c504d09fc722d190683d0262aaron Print a specific metadata value or set of metadata values.
dc098c7ce5d36179c504d09fc722d190683d0262aaron The <code class="option">-p</code> option may be followed by one or more
dc098c7ce5d36179c504d09fc722d190683d0262aaron of the following letters to indicate which value or values to print:
dc098c7ce5d36179c504d09fc722d190683d0262aaron <code class="option">P</code> for the publication date,
364dfd4527e6ce37b828a42e2c0bbdf9ba19a9b8gregames <code class="option">A</code> for the activation date,
364dfd4527e6ce37b828a42e2c0bbdf9ba19a9b8gregames <code class="option">R</code> for the revocation date,
dc098c7ce5d36179c504d09fc722d190683d0262aaron <code class="option">I</code> for the inactivation date, or
0bcb1fe39dfaacf9745b6633f5cc9ebc8e2596caaaron To print all of the metadata, use <code class="option">-p all</code>.
33f5961d34a8b5390cebad0543b3ebe67830e5d7jerenkrantz<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
33f5961d34a8b5390cebad0543b3ebe67830e5d7jerenkrantz <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
33f5961d34a8b5390cebad0543b3ebe67830e5d7jerenkrantz <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
33f5961d34a8b5390cebad0543b3ebe67830e5d7jerenkrantz<p><span class="corpauthor">Internet Systems Consortium</span>
54e1babd5a5a56c576eeeace54110150769cc916coar<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
54e1babd5a5a56c576eeeace54110150769cc916coar<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
54e1babd5a5a56c576eeeace54110150769cc916coar<td width="40%" align="right">�<a accesskey="n" href="man.dnssec-signzone.html">Next</a>
949aa7bba7f804faa8e6b08cad42a98fc0255d85jerenkrantz<span class="application">dnssec-revoke</span>�</td>
949aa7bba7f804faa8e6b08cad42a98fc0255d85jerenkrantz<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
949aa7bba7f804faa8e6b08cad42a98fc0255d85jerenkrantz<td width="40%" align="right" valign="top">�<span class="application">dnssec-signzone</span>
07021d9f405849228b859d9fb4b877f20e4fbba3jerenkrantz<p style="text-align: center;">BIND 9.11.0pre-alpha</p>