man.dnssec-signzone.html revision 1fdd2470b625a58b57d0b155e6caf8c4fc0afe8a
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<!--
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews -
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - Permission to use, copy, modify, and distribute this software for any
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - purpose with or without fee is hereby granted, provided that the above
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - copyright notice and this permission notice appear in all copies.
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews -
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
7ecbfb6c0f566894fb7050e021cded6822771789Mark Andrews - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews - PERFORMANCE OF THIS SOFTWARE.
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews-->
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<!-- $Id: man.dnssec-signzone.html,v 1.97 2009/01/08 01:11:51 tbox Exp $ -->
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<html>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<head>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<title>dnssec-signzone</title>
f41405d21249e11c1636301b1324ac1937b455aaMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
7e8f841d085cbd14b270f7bb9e2a2b7c5bc22565Mark Andrews<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
7e8f841d085cbd14b270f7bb9e2a2b7c5bc22565Mark Andrews<link rel="prev" href="man.dnssec-keygen.html" title="dnssec-keygen">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews</head>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<div class="navheader">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<table width="100%" summary="Navigation header">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
7e8f841d085cbd14b270f7bb9e2a2b7c5bc22565Mark Andrews<tr>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<td width="20%" align="left">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<a accesskey="p" href="man.dnssec-keygen.html">Prev</a>�</td>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<th width="60%" align="center">Manual pages</th>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews</td>
33518843817dd9cf127eb09c5952227f1972af55Mark Andrews</tr>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews</table>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<hr>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews</div>
7e8f841d085cbd14b270f7bb9e2a2b7c5bc22565Mark Andrews<div class="refentry" lang="en">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<div class="refnamediv">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<h2>Name</h2>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<p><span class="application">dnssec-signzone</span> &#8212; DNSSEC zone signing tool</p>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews</div>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<div class="refsynopsisdiv">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<h2>Synopsis</h2>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews</div>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<div class="refsect1" lang="en">
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<a name="id2606981"></a><h2>DESCRIPTION</h2>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<p><span><strong class="command">dnssec-signzone</strong></span>
d39690e5a9b4a9a084d984abd193bed4395db41aDavid Lawrence signs a zone. It generates
d39690e5a9b4a9a084d984abd193bed4395db41aDavid Lawrence NSEC and RRSIG records and produces a signed version of the
105f5a65b1f680f4cb6f897b8b0f7ee7e09e41ebDavid Lawrence zone. The security status of delegations from the signed zone
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews (that is, whether the child zones are secure or not) is
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews determined by the presence or absence of a
88b3bc12b5570aae77e5963204e9111a2875915eAndreas Gustafsson <code class="filename">keyset</code> file for each child zone.
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews </p>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews</div>
8886caf5dc3db70638022ddfd5442c0930bd43b5Mark Andrews<div class="refsect1" lang="en">
ff8fd4d1b6abb0490b5aaf2b1d86555750ae0818Mark Andrews<a name="id2607000"></a><h2>OPTIONS</h2>
ff8fd4d1b6abb0490b5aaf2b1d86555750ae0818Mark Andrews<div class="variablelist"><dl>
1c9200af084f2b6f1d28eccf91525676c158cfa3Mark Andrews<dt><span class="term">-a</span></dt>
ff8fd4d1b6abb0490b5aaf2b1d86555750ae0818Mark Andrews<dd><p>
9463feb3cb002df10b053f71e21540607c7a48e8Tatuya JINMEI 神明達哉 Verify all generated signatures.
c05a979fda35c83d7fba16fee7859644e98a7450Mark Andrews </p></dd>
2a313f56e78e19ae6dc2315bb53bd32fad13ae29Mark Andrews<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
fcb54ce0a4f7377486df5bec83b3aa4711bf4131Mark Andrews<dd><p>
58e0b35a3bbb50d154c36749096f7463dab75a7aMark Andrews Specifies the DNS class of the zone.
60c2c8814f838f503333da5b2fd7e6792ca39c14Mark Andrews </p></dd>
c58088e3a0fd9e553db750cd4b08d3e621d0ded4Mark Andrews<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
b9858c2efcee324745a1b8d7b099baf540bc695bMark Andrews<dd><p>
5a020bc04be73df06735da0ec1abb1dd71c755e5Mark Andrews Treat specified key as a key signing key ignoring any
5a020bc04be73df06735da0ec1abb1dd71c755e5Mark Andrews key flags. This option may be specified multiple times.
5a020bc04be73df06735da0ec1abb1dd71c755e5Mark Andrews </p></dd>
5a020bc04be73df06735da0ec1abb1dd71c755e5Mark Andrews<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
58e0b35a3bbb50d154c36749096f7463dab75a7aMark Andrews<dd><p>
a69a77ddfef58e93036cf6173dc7f91ed864d103Mark Andrews Generate a DLV set in addition to the key (DNSKEY) and DS sets.
f4545143206d918a7f6ee53cd4fb9788c534c0c7Mark Andrews The domain is appended to the name of the records.
09233633dadbd7878e60dd383a814e24e5eda1c6Mark Andrews </p></dd>
09233633dadbd7878e60dd383a814e24e5eda1c6Mark Andrews<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
7ecbfb6c0f566894fb7050e021cded6822771789Mark Andrews<dd><p>
ea37c1a7780311cc7076ff54f09774b2296aebe5Mark Andrews Look for <code class="filename">keyset</code> files in
de90c0b2efac159580365beaa761a14bdb74330cMark Andrews <code class="option">directory</code> as the directory
49aa1303a7cf1ec2a06cde11e46a039dddfca8feMark Andrews </p></dd>
e20eae14fc554bae394f535067e80884b59d0684Mark Andrews<dt><span class="term">-g</span></dt>
e03d4ecce3b62bb0a02d2f5e2cc1a9549df08498Mark Andrews<dd><p>
7ecbfb6c0f566894fb7050e021cded6822771789Mark Andrews Generate DS records for child zones from keyset files.
1c8c1aa1c6a103a6495109069cca518c9f475f39Mark Andrews Existing DS records will be removed.
d4ae7d9200ebad7700e8e85886cabe93ab24afd8Mark Andrews </p></dd>
b6f837397dadf6b296ee1825c95e90235ee5b5ffMark Andrews<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
7ecbfb6c0f566894fb7050e021cded6822771789Mark Andrews<dd><p>
d4cefad19e32879e6847df043e62ad8f9cbfa06bMark Andrews Specify the date and time when the generated RRSIG records
2984f8f7bf213642e47affe710851ff0d6580083Mark Andrews become valid. This can be either an absolute or relative
666bae3ccc9d50d840dd6b7b13731f7653f74e77Mark Andrews time. An absolute start time is indicated by a number
a14a8a963a407d636f76e223704f62440bd10176Mark Andrews in YYYYMMDDHHMMSS notation; 20000530144500 denotes
fd6574dbc551faac89ae2ce6f3549fed51c24e49Mark Andrews 14:45:00 UTC on May 30th, 2000. A relative start time is
fd6574dbc551faac89ae2ce6f3549fed51c24e49Mark Andrews indicated by +N, which is N seconds from the current time.
fd6574dbc551faac89ae2ce6f3549fed51c24e49Mark Andrews If no <code class="option">start-time</code> is specified, the current
cb6fe566ff051ade7b99f5ca9fca897193d1bd4fMark Andrews time minus 1 hour (to allow for clock skew) is used.
d3e93aac7a6a647b1a2905bfdbdd5ce1b9e46a73Mark Andrews </p></dd>
245bce4ef1e9b3e7e802141dba7c2ca878e4768bMark Andrews<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
00b872e4f76587584a2359e9001e9cf08b195ccfMark Andrews<dd><p>
aacfb65e0ae7087bdb4f76fb72b7ee3b46893440Mark Andrews Specify the date and time when the generated RRSIG records
85f5fe1a722626b33eb9a490def709d02a35e65dMark Andrews expire. As with <code class="option">start-time</code>, an absolute
b26014a1945864a54464b413279faad7dad6d772Mark Andrews time is indicated in YYYYMMDDHHMMSS notation. A time relative
886fff19f145c93c64967a87e1ff5a9ce18503a6Mark Andrews to the start time is indicated with +N, which is N seconds from
bda34793bb9f407390fd54cef8e5846c357e55c6Mark Andrews the start time. A time relative to the current time is
bda34793bb9f407390fd54cef8e5846c357e55c6Mark Andrews indicated with now+N. If no <code class="option">end-time</code> is
2b59366035cf1add576318ab336e6b4bdf170e0fMark Andrews specified, 30 days from the start time is used as a default.
cdd28dc017ce03d208cdfbe7d55fb76377c85accMark Andrews </p></dd>
c1c9e72292db84ebf69093f38a2d1a4a60aeebabMark Andrews<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
209b1d150ce0b5d8963b1ba39664e80256929011Mark Andrews<dd><p>
7ecbfb6c0f566894fb7050e021cded6822771789Mark Andrews The name of the output file containing the signed zone. The
7ecbfb6c0f566894fb7050e021cded6822771789Mark Andrews default is to append <code class="filename">.signed</code> to
024383c7cfdcb1d06779c10949ab413c98a5983eMark Andrews the
e438f713c6340f4de9bc528d8c9fb55654a30616Mark Andrews input filename.
1e18f761a7f406c5c472ddefea9513c80a67efacMark Andrews </p></dd>
<dt><span class="term">-h</span></dt>
<dd><p>
Prints a short summary of the options and arguments to
<span><strong class="command">dnssec-signzone</strong></span>.
</p></dd>
<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
<dd>
<p>
When a previously-signed zone is passed as input, records
may be resigned. The <code class="option">interval</code> option
specifies the cycle interval as an offset from the current
time (in seconds). If a RRSIG record expires after the
cycle interval, it is retained. Otherwise, it is considered
to be expiring soon, and it will be replaced.
</p>
<p>
The default cycle interval is one quarter of the difference
between the signature end and start times. So if neither
<code class="option">end-time</code> or <code class="option">start-time</code>
are specified, <span><strong class="command">dnssec-signzone</strong></span>
generates
signatures that are valid for 30 days, with a cycle
interval of 7.5 days. Therefore, if any existing RRSIG records
are due to expire in less than 7.5 days, they would be
replaced.
</p>
</dd>
<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
<dd><p>
The format of the input zone file.
Possible formats are <span><strong class="command">"text"</strong></span> (default)
and <span><strong class="command">"raw"</strong></span>.
This option is primarily intended to be used for dynamic
signed zones so that the dumped zone file in a non-text
format containing updates can be signed directly.
The use of this option does not make much sense for
non-dynamic zones.
</p></dd>
<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
<dd>
<p>
When signing a zone with a fixed signature lifetime, all
RRSIG records issued at the time of signing expires
simultaneously. If the zone is incrementally signed, i.e.
a previously-signed zone is passed as input to the signer,
all expired signatures have to be regenerated at about the
same time. The <code class="option">jitter</code> option specifies a
jitter window that will be used to randomize the signature
expire time, thus spreading incremental signature
regeneration over time.
</p>
<p>
Signature lifetime jitter also to some extent benefits
validators and servers by spreading out cache expiration,
i.e. if large numbers of RRSIGs don't expire at the same time
from all caches there will be less congestion than if all
validators need to refetch at mostly the same time.
</p>
</dd>
<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
<dd><p>
Specifies the number of threads to use. By default, one
thread is started for each detected CPU.
</p></dd>
<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
<dd>
<p>
The SOA serial number format of the signed zone.
Possible formats are <span><strong class="command">"keep"</strong></span> (default),
<span><strong class="command">"increment"</strong></span> and
<span><strong class="command">"unixtime"</strong></span>.
</p>
<div class="variablelist"><dl>
<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt>
<dd><p>Do not modify the SOA serial number.</p></dd>
<dt><span class="term"><span><strong class="command">"increment"</strong></span></span></dt>
<dd><p>Increment the SOA serial number using RFC 1982
arithmetics.</p></dd>
<dt><span class="term"><span><strong class="command">"unixtime"</strong></span></span></dt>
<dd><p>Set the SOA serial number to the number of seconds
since epoch.</p></dd>
</dl></div>
</dd>
<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
<dd><p>
The zone origin. If not specified, the name of the zone file
is assumed to be the origin.
</p></dd>
<dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt>
<dd><p>
The format of the output file containing the signed zone.
Possible formats are <span><strong class="command">"text"</strong></span> (default)
and <span><strong class="command">"raw"</strong></span>.
</p></dd>
<dt><span class="term">-p</span></dt>
<dd><p>
Use pseudo-random data when signing the zone. This is faster,
but less secure, than using real random data. This option
may be useful when signing large zones or when the entropy
source is limited.
</p></dd>
<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
<dd><p>
Specifies the source of randomness. If the operating
system does not provide a <code class="filename">/dev/random</code>
or equivalent device, the default source of randomness
is keyboard input. <code class="filename">randomdev</code>
specifies
the name of a character device or file containing random
data to be used instead of the default. The special value
<code class="filename">keyboard</code> indicates that keyboard
input should be used.
</p></dd>
<dt><span class="term">-t</span></dt>
<dd><p>
Print statistics at completion.
</p></dd>
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
<dd><p>
Sets the debugging level.
</p></dd>
<dt><span class="term">-z</span></dt>
<dd><p>
Ignore KSK flag on key when determining what to sign.
</p></dd>
<dt><span class="term">-3 <em class="replaceable"><code>salt</code></em></span></dt>
<dd><p>
Generate a NSEC3 chain with the given hex encoded salt.
A dash (<em class="replaceable"><code>salt</code></em>) can
be used to indicate that no salt is to be used when generating the NSEC3 chain.
</p></dd>
<dt><span class="term">-H <em class="replaceable"><code>iterations</code></em></span></dt>
<dd><p>
When generating a NSEC3 chain use this many interations. The
default is 100.
</p></dd>
<dt><span class="term">-A</span></dt>
<dd><p>
When generating a NSEC3 chain set the OPTOUT flag on all
NSEC3 records and do not generate NSEC3 records for insecure
delegations.
</p></dd>
<dt><span class="term">zonefile</span></dt>
<dd><p>
The file containing the zone to be signed.
</p></dd>
<dt><span class="term">key</span></dt>
<dd><p>
Specify which keys should be used to sign the zone. If
no keys are specified, then the zone will be examined
for DNSKEY records at the zone apex. If these are found and
there are matching private keys, in the current directory,
then these will be used for signing.
</p></dd>
</dl></div>
</div>
<div class="refsect1" lang="en">
<a name="id2658187"></a><h2>EXAMPLE</h2>
<p>
The following command signs the <strong class="userinput"><code>example.com</code></strong>
zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
(Kexample.com.+003+17247). The zone's keys must be in the master
file (<code class="filename">db.example.com</code>). This invocation looks
for <code class="filename">keyset</code> files, in the current directory,
so that DS records can be generated from them (<span><strong class="command">-g</strong></span>).
</p>
<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
Kexample.com.+003+17247
db.example.com.signed
%</pre>
<p>
In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates
the file <code class="filename">db.example.com.signed</code>. This
file should be referenced in a zone statement in a
<code class="filename">named.conf</code> file.
</p>
<p>
This example re-signs a previously signed zone with default parameters.
The private keys are assumed to be in the current directory.
</p>
<pre class="programlisting">% cp db.example.com.signed db.example.com
% dnssec-signzone -o example.com db.example.com
db.example.com.signed
%</pre>
</div>
<div class="refsect1" lang="en">
<a name="id2658260"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
<em class="citetitle">RFC 4033</em>.
</p>
</div>
<div class="refsect1" lang="en">
<a name="id2658284"></a><h2>AUTHOR</h2>
<p><span class="corpauthor">Internet Systems Consortium</span>
</p>
</div>
</div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
<a accesskey="p" href="man.dnssec-keygen.html">Prev</a>�</td>
<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td>
<td width="40%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
</td>
</tr>
<tr>
<td width="40%" align="left" valign="top">
<span class="application">dnssec-keygen</span>�</td>
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
<td width="40%" align="right" valign="top">�<span class="application">named-checkconf</span>
</td>
</tr>
</table>
</div>
</body>
</html>