man.dnssec-signzone.html revision 2cbb4ab75757fbb656997a82c14ca07db37d481a
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Permission to use, copy, modify, and distribute this software for any
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - purpose with or without fee is hereby granted, provided that the above
8c225507766814e78e168b17a24b8a47ca7f8c37Tinderbox User - copyright notice and this permission notice appear in all copies.
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User - PERFORMANCE OF THIS SOFTWARE.
f9ce6280cec79deb16ff6d9807aa493ff23e10d9Tinderbox User<!-- $Id: man.dnssec-signzone.html,v 1.120 2009/07/04 01:13:18 tbox Exp $ -->
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<link rel="prev" href="man.dnssec-revoke.html" title="dnssec-revoke">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<table width="100%" summary="Navigation header">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a accesskey="p" href="man.dnssec-revoke.html">Prev</a>�</td>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-P</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User<p><span><strong class="command">dnssec-signzone</strong></span>
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User signs a zone. It generates
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User NSEC and RRSIG records and produces a signed version of the
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User zone. The security status of delegations from the signed zone
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User (that is, whether the child zones are secure or not) is
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User determined by the presence or absence of a
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User <code class="filename">keyset</code> file for each child zone.
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User Verify all generated signatures.
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User Specifies the DNS class of the zone.
a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Treat specified key as a key signing key ignoring any
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User key flags. This option may be specified multiple times.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Generate a DLV set in addition to the key (DNSKEY) and DS sets.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User The domain is appended to the name of the records.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Look for <code class="filename">keyset</code> files in
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="option">directory</code> as the directory
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Generate DS records for child zones from keyset files.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Existing DS records will be removed.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Specify the date and time when the generated RRSIG records
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User become valid. This can be either an absolute or relative
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User time. An absolute start time is indicated by a number
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User in YYYYMMDDHHMMSS notation; 20000530144500 denotes
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User 14:45:00 UTC on May 30th, 2000. A relative start time is
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User indicated by +N, which is N seconds from the current time.
a1ff871f78b7d907d6fc3a382beea2a640fe8423Tinderbox User If no <code class="option">start-time</code> is specified, the current
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User time minus 1 hour (to allow for clock skew) is used.
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User Specify the date and time when the generated RRSIG records
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User expire. As with <code class="option">start-time</code>, an absolute
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User time is indicated in YYYYMMDDHHMMSS notation. A time relative
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User to the start time is indicated with +N, which is N seconds from
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User the start time. A time relative to the current time is
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User indicated with now+N. If no <code class="option">end-time</code> is
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt specified, 30 days from the start time is used as a default.
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User The name of the output file containing the signed zone. The
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User default is to append <code class="filename">.signed</code> to
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User input filename.
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User Prints a short summary of the options and arguments to
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User <span><strong class="command">dnssec-signzone</strong></span>.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User When a previously-signed zone is passed as input, records
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User may be resigned. The <code class="option">interval</code> option
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User specifies the cycle interval as an offset from the current
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User time (in seconds). If a RRSIG record expires after the
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User cycle interval, it is retained. Otherwise, it is considered
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User to be expiring soon, and it will be replaced.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The default cycle interval is one quarter of the difference
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User between the signature end and start times. So if neither
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User <code class="option">end-time</code> or <code class="option">start-time</code>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt are specified, <span><strong class="command">dnssec-signzone</strong></span>
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User signatures that are valid for 30 days, with a cycle
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User interval of 7.5 days. Therefore, if any existing RRSIG records
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User are due to expire in less than 7.5 days, they would be
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User The format of the input zone file.
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User Possible formats are <span><strong class="command">"text"</strong></span> (default)
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User and <span><strong class="command">"raw"</strong></span>.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User This option is primarily intended to be used for dynamic
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User signed zones so that the dumped zone file in a non-text
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User format containing updates can be signed directly.
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User The use of this option does not make much sense for
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User non-dynamic zones.
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User When signing a zone with a fixed signature lifetime, all
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User RRSIG records issued at the time of signing expires
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User simultaneously. If the zone is incrementally signed, i.e.
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User a previously-signed zone is passed as input to the signer,
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User all expired signatures have to be regenerated at about the
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User same time. The <code class="option">jitter</code> option specifies a
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User jitter window that will be used to randomize the signature
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User expire time, thus spreading incremental signature
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User regeneration over time.
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User Signature lifetime jitter also to some extent benefits
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User validators and servers by spreading out cache expiration,
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User i.e. if large numbers of RRSIGs don't expire at the same time
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User from all caches there will be less congestion than if all
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User validators need to refetch at mostly the same time.
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User Specifies the number of threads to use. By default, one
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User thread is started for each detected CPU.
421ba11f3f07cbcb12c288ef7f4e7bad13fcc28fTinderbox User<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
421ba11f3f07cbcb12c288ef7f4e7bad13fcc28fTinderbox User The SOA serial number format of the signed zone.
421ba11f3f07cbcb12c288ef7f4e7bad13fcc28fTinderbox User Possible formats are <span><strong class="command">"keep"</strong></span> (default),
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User <span><strong class="command">"increment"</strong></span> and
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User <span><strong class="command">"unixtime"</strong></span>.
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt>
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User<dd><p>Do not modify the SOA serial number.</p></dd>
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User<dt><span class="term"><span><strong class="command">"increment"</strong></span></span></dt>
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User<dd><p>Increment the SOA serial number using RFC 1982
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User<dt><span class="term"><span><strong class="command">"unixtime"</strong></span></span></dt>
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User<dd><p>Set the SOA serial number to the number of seconds
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User The zone origin. If not specified, the name of the zone file
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User is assumed to be the origin.
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User<dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt>
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User The format of the output file containing the signed zone.
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User Possible formats are <span><strong class="command">"text"</strong></span> (default)
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User and <span><strong class="command">"raw"</strong></span>.
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User Use pseudo-random data when signing the zone. This is faster,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt but less secure, than using real random data. This option
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User may be useful when signing large zones or when the entropy
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt source is limited.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Disable post sign verification tests.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The post sign verification test ensures that for each algorithm
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User in use there is at least one non revoked self signed KSK key,
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt that all revoked KSK keys are self signed, and that all records
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt in the zone are signed by the algorithm.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt This option skips these tests.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User Specifies the source of randomness. If the operating
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User system does not provide a <code class="filename">/dev/random</code>
(Kexample.com.+003+17247). The zone's keys must be in the master
Kexample.com.+003+17247