man.dnssec-signzone.html revision 4abdfc917e6635a7c81d1f931a0c79227e72d025
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - Copyright (C) 2000-2003 Internet Software Consortium.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - Permission to use, copy, modify, and distribute this software for any
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - purpose with or without fee is hereby granted, provided that the above
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - copyright notice and this permission notice appear in all copies.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser - PERFORMANCE OF THIS SOFTWARE.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<!-- $Id: man.dnssec-signzone.html,v 1.37 2007/01/26 23:29:04 marka Exp $ -->
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<link rel="prev" href="man.dnssec-keygen.html" title="dnssec-keygen">
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<a accesskey="p" href="man.dnssec-keygen.html">Prev</a>�</td>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<p><span><strong class="command">dnssec-signzone</strong></span>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser signs a zone. It generates
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser NSEC and RRSIG records and produces a signed version of the
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser zone. The security status of delegations from the signed zone
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser (that is, whether the child zones are secure or not) is
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser determined by the presence or absence of a
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser <code class="filename">keyset</code> file for each child zone.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Verify all generated signatures.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Specifies the DNS class of the zone.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Treat specified key as a key signing key ignoring any
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser key flags. This option may be specified multiple times.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Generate a DLV set in addition to the key (DNSKEY) and DS sets.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser The domain is appended to the name of the records.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Look for <code class="filename">keyset</code> files in
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser <code class="option">directory</code> as the directory
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Generate DS records for child zones from keyset files.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Existing DS records will be removed.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Specify the date and time when the generated RRSIG records
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser become valid. This can be either an absolute or relative
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser time. An absolute start time is indicated by a number
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser in YYYYMMDDHHMMSS notation; 20000530144500 denotes
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser 14:45:00 UTC on May 30th, 2000. A relative start time is
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser indicated by +N, which is N seconds from the current time.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser If no <code class="option">start-time</code> is specified, the current
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser time minus 1 hour (to allow for clock skew) is used.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Specify the date and time when the generated RRSIG records
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser expire. As with <code class="option">start-time</code>, an absolute
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser time is indicated in YYYYMMDDHHMMSS notation. A time relative
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser to the start time is indicated with +N, which is N seconds from
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser the start time. A time relative to the current time is
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser indicated with now+N. If no <code class="option">end-time</code> is
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser specified, 30 days from the start time is used as a default.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser The name of the output file containing the signed zone. The
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser default is to append <code class="filename">.signed</code> to
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Prints a short summary of the options and arguments to
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser <span><strong class="command">dnssec-signzone</strong></span>.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser When a previously signed zone is passed as input, records
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser may be resigned. The <code class="option">interval</code> option
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser specifies the cycle interval as an offset from the current
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser time (in seconds). If a RRSIG record expires after the
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser cycle interval, it is retained. Otherwise, it is considered
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser to be expiring soon, and it will be replaced.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser The default cycle interval is one quarter of the difference
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser between the signature end and start times. So if neither
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser <code class="option">end-time</code> or <code class="option">start-time</code>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser are specified, <span><strong class="command">dnssec-signzone</strong></span>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser signatures that are valid for 30 days, with a cycle
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser interval of 7.5 days. Therefore, if any existing RRSIG records
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser are due to expire in less than 7.5 days, they would be
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser The format of the input zone file.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser Possible formats are <span><strong class="command">"text"</strong></span> (default)
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser and <span><strong class="command">"raw"</strong></span>.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser This option is primarily intended to be used for dynamic
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser signed zones so that the dumped zone file in a non-text
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser format containing updates can be signed directly.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser The use of this option does not make much sense for
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser non-dynamic zones.
65d8ae9c4a66f5ca85289c02dc06d63261c84619Scott Moser<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
simultaneously. If the zone is incrementally signed, i.e.
i.e. if large numbers of RRSIGs don't expire at the same time