man.dnssec-signzone.html revision e4adb07cc1f8253b3c39aeeeb3ea03dc5b7011cc
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Copyright (C) 2000-2003 Internet Software Consortium.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User - Permission to use, copy, modify, and/or distribute this software for any
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - purpose with or without fee is hereby granted, provided that the above
8c225507766814e78e168b17a24b8a47ca7f8c37Tinderbox User - copyright notice and this permission notice appear in all copies.
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
1c57c3f79db0bf0358bbe6d7b5ad650c0c852f4bTinderbox User - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User - PERFORMANCE OF THIS SOFTWARE.
f9ce6280cec79deb16ff6d9807aa493ff23e10d9Tinderbox User<!-- $Id: man.dnssec-signzone.html,v 1.142 2009/10/27 01:14:44 tbox Exp $ -->
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<link rel="prev" href="man.dnssec-settime.html" title="dnssec-settime">
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User<link rel="next" href="man.named-checkconf.html" title="named-checkconf">
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<table width="100%" summary="Navigation header">
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a accesskey="p" href="man.dnssec-settime.html">Prev</a>�</td>
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-P</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User<p><span><strong class="command">dnssec-signzone</strong></span>
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User signs a zone. It generates
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User NSEC and RRSIG records and produces a signed version of the
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User zone. The security status of delegations from the signed zone
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User (that is, whether the child zones are secure or not) is
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User determined by the presence or absence of a
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User <code class="filename">keyset</code> file for each child zone.
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User Verify all generated signatures.
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
33c9436ef1a43d3c0fc3d9be9b4b0509daa83223Tinderbox User Specifies the DNS class of the zone.
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User Compatibility mode: Generate a
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code>
0da02c26a6631c25f075a8e4ac6de9e58f49a0c2Tinderbox User file in addition to
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User when signing a zone, for use by older versions of
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User <span><strong class="command">dnssec-signzone</strong></span>.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Look for <code class="filename">dsset-</code> or
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User <code class="filename">keyset-</code> files in <code class="option">directory</code>.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Uses a crypto hardware (OpenSSL engine) for the crypto operations
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User it supports, for instance signing with private keys from
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User a secure key store. When compiled with PKCS#11 support
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User it defaults to pcks11, the empty name resets it to no engine.
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User Generate DS records for child zones from
8a48b6b9b6fa8486f24b22d1972b2b6ebb36a4a4Tinderbox User <code class="filename">dsset-</code> or <code class="filename">keyset-</code>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User file. Existing DS records will be removed.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User Key repository: Specify a directory to search for DNSSEC keys.
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User If not specified, defaults to the current directory.
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User Treat specified key as a key signing key ignoring any
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User key flags. This option may be specified multiple times.
363b21045b718d06d414784c96193dc9a233e8c5Tinderbox User<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Generate a DLV set in addition to the key (DNSKEY) and DS sets.
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User The domain is appended to the name of the records.
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User Specify the date and time when the generated RRSIG records
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User become valid. This can be either an absolute or relative
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User time. An absolute start time is indicated by a number
550d3276d0490c4918f089ccb1528a3eb0951b0aTinderbox User in YYYYMMDDHHMMSS notation; 20000530144500 denotes
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User 14:45:00 UTC on May 30th, 2000. A relative start time is
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User indicated by +N, which is N seconds from the current time.
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User If no <code class="option">start-time</code> is specified, the current
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User time minus 1 hour (to allow for clock skew) is used.
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User Specify the date and time when the generated RRSIG records
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User expire. As with <code class="option">start-time</code>, an absolute
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User time is indicated in YYYYMMDDHHMMSS notation. A time relative
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User to the start time is indicated with +N, which is N seconds from
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User the start time. A time relative to the current time is
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User indicated with now+N. If no <code class="option">end-time</code> is
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User specified, 30 days from the start time is used as a default.
51da15c88648a9e47d0cddff4b2b782665e99401Tinderbox User <code class="option">end-time</code> must be later than
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The name of the output file containing the signed zone. The
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt default is to append <code class="filename">.signed</code> to
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User input filename.
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User Prints a short summary of the options and arguments to
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User <span><strong class="command">dnssec-signzone</strong></span>.
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User When a previously-signed zone is passed as input, records
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User may be resigned. The <code class="option">interval</code> option
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User specifies the cycle interval as an offset from the current
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User time (in seconds). If a RRSIG record expires after the
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User cycle interval, it is retained. Otherwise, it is considered
164ade1482251e1da962b42e5bf0d3aa02a11e03Tinderbox User to be expiring soon, and it will be replaced.
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User The default cycle interval is one quarter of the difference
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User between the signature end and start times. So if neither
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User <code class="option">end-time</code> or <code class="option">start-time</code>
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User are specified, <span><strong class="command">dnssec-signzone</strong></span>
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User signatures that are valid for 30 days, with a cycle
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User interval of 7.5 days. Therefore, if any existing RRSIG records
abe69df9a7de5cda07a2b8e19e8b7c981bcd7a9dTinderbox User are due to expire in less than 7.5 days, they would be
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User The format of the input zone file.
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User Possible formats are <span><strong class="command">"text"</strong></span> (default)
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User and <span><strong class="command">"raw"</strong></span>.
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User This option is primarily intended to be used for dynamic
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User signed zones so that the dumped zone file in a non-text
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User format containing updates can be signed directly.
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User The use of this option does not make much sense for
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User non-dynamic zones.
8c7245514646663b25d8b186186ebede41903fa3Tinderbox User<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
421ba11f3f07cbcb12c288ef7f4e7bad13fcc28fTinderbox User When signing a zone with a fixed signature lifetime, all
421ba11f3f07cbcb12c288ef7f4e7bad13fcc28fTinderbox User RRSIG records issued at the time of signing expires
421ba11f3f07cbcb12c288ef7f4e7bad13fcc28fTinderbox User simultaneously. If the zone is incrementally signed, i.e.
421ba11f3f07cbcb12c288ef7f4e7bad13fcc28fTinderbox User a previously-signed zone is passed as input to the signer,
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User all expired signatures have to be regenerated at about the
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User same time. The <code class="option">jitter</code> option specifies a
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User jitter window that will be used to randomize the signature
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User expire time, thus spreading incremental signature
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User regeneration over time.
3b15473cedf41d48904f5b07bdc5e87afff6b58cTinderbox User Signature lifetime jitter also to some extent benefits
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User validators and servers by spreading out cache expiration,
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User i.e. if large numbers of RRSIGs don't expire at the same time
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User from all caches there will be less congestion than if all
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User validators need to refetch at mostly the same time.
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User Specifies the number of threads to use. By default, one
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User thread is started for each detected CPU.
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
c48fdfda7a8ae8973aadfeb88cbeaab013024a6cTinderbox User The SOA serial number format of the signed zone.
99b30e26a6beb9092557cc9e5370b517309bff6eTinderbox User Possible formats are <span><strong class="command">"keep"</strong></span> (default),
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User <span><strong class="command">"increment"</strong></span> and
ffe29868b4bbc64953fc5d0de51f988c20158967Tinderbox User <span><strong class="command">"unixtime"</strong></span>.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dd><p>Do not modify the SOA serial number.</p></dd>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="term"><span><strong class="command">"increment"</strong></span></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dd><p>Increment the SOA serial number using RFC 1982
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt<dt><span class="term"><span><strong class="command">"unixtime"</strong></span></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dd><p>Set the SOA serial number to the number of seconds
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt The zone origin. If not specified, the name of the zone file
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt is assumed to be the origin.
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User<dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt>
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User The format of the output file containing the signed zone.
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt Possible formats are <span><strong class="command">"text"</strong></span> (default)
7911e6f9de303bca5a3d8b34f4330c8f7cecffaeTinderbox User and <span><strong class="command">"raw"</strong></span>.
Kexample.com.+003+17247