man.dnssec-signzone.html revision f5c27ecceb6dcba6ad8b75172fe5f9823d7a6d42
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC")
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence - Copyright (C) 2000-2003 Internet Software Consortium.
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - Permission to use, copy, modify, and/or distribute this software for any
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - purpose with or without fee is hereby granted, provided that the above
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - copyright notice and this permission notice appear in all copies.
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley - PERFORMANCE OF THIS SOFTWARE.
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley<!-- $Id$ -->
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<link rel="prev" href="man.dnssec-settime.html" title="dnssec-settime">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<link rel="next" href="man.dnssec-verify.html" title="dnssec-verify">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<table width="100%" summary="Navigation header">
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a accesskey="p" href="man.dnssec-settime.html">Prev</a>�</td>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-verify.html">Next</a>
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington<a name="man.dnssec-signzone"></a><div class="titlepage"></div>
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p>
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington<a name="id2673282"></a><h2>DESCRIPTION</h2>
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington<p><span><strong class="command">dnssec-signzone</strong></span>
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley signs a zone. It generates
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein NSEC and RRSIG records and produces a signed version of the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein zone. The security status of delegations from the signed zone
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein (that is, whether the child zones are secure or not) is
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein determined by the presence or absence of a
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington <code class="filename">keyset</code> file for each child zone.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Verify all generated signatures.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
942d1a339b1fe617f7d17d66cb5fccce798d15aeBrian Wellington Specifies the DNS class of the zone.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Compatibility mode: Generate a
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code>
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley file in addition to
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code>
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence when signing a zone, for use by older versions of
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence <span><strong class="command">dnssec-signzone</strong></span>.
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki Look for <code class="filename">dsset-</code> or
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki <code class="filename">keyset-</code> files in <code class="option">directory</code>.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Output only those record types automatically managed by
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <span><strong class="command">dnssec-signzone</strong></span>, i.e. RRSIG, NSEC,
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein NSEC3 and NSEC3PARAM records. If smart signing
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews (<code class="option">-S</code>) is used, DNSKEY records are also
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews included. The resulting file can be included in the original
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein zone file with <span><strong class="command">$INCLUDE</strong></span>. This option
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein cannot be combined with <code class="option">-O raw</code>,
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="option">-O map</code>, or serial number updating.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein When applicable, specifies the hardware to use for
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews cryptographic operations, such as a secure key store used
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews for signing.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews When BIND is built with OpenSSL PKCS#11 support, this defaults
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews to the string "pkcs11", which identifies an OpenSSL engine
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews that can drive a cryptographic accelerator or hardware service
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews module. When BIND is built with native PKCS#11 cryptography
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews (--enable-native-pkcs11), it defaults to the path of the PKCS#11
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein provider library specified via "--with-pkcs11".
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Generate DS records for child zones from
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="filename">dsset-</code> or <code class="filename">keyset-</code>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews file. Existing DS records will be removed.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Key repository: Specify a directory to search for DNSSEC keys.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews If not specified, defaults to the current directory.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Treat specified key as a key signing key ignoring any
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein key flags. This option may be specified multiple times.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki Generate a DLV set in addition to the key (DNSKEY) and DS sets.
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki The domain is appended to the name of the records.
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki<dt><span class="term">-M <em class="replaceable"><code>maxttl</code></em></span></dt>
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki Sets the maximum TTL for the signed zone.
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki Any TTL higher than <em class="replaceable"><code>maxttl</code></em> in the
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki input zone will be reduced to <em class="replaceable"><code>maxttl</code></em>
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki in the output. This provides certainty as to the largest
bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0Witold Krecicki possible TTL in the signed zone, which is useful to know when
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews rolling keys because it is the longest possible time before
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews signatures that have been retrieved by resolvers will expire
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews from resolver caches. Zones that are signed with this
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews option should be configured to use a matching
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews <code class="option">max-zone-ttl</code> in <code class="filename">named.conf</code>.
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews (Note: This option is incompatible with <code class="option">-D</code>,
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews because it modifies non-DNSSEC data in the output zone.)
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews Specify the date and time when the generated RRSIG records
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews become valid. This can be either an absolute or relative
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews time. An absolute start time is indicated by a number
3678015d3f91ad80e7ea5fc4c6ee00e16c9f40aeFrancis Dupont in YYYYMMDDHHMMSS notation; 20000530144500 denotes
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews 14:45:00 UTC on May 30th, 2000. A relative start time is
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews indicated by +N, which is N seconds from the current time.
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews If no <code class="option">start-time</code> is specified, the current
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews time minus 1 hour (to allow for clock skew) is used.
39c7fc7e00af20144b94ef332943f62c1b3a622fMark Andrews<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews Specify the date and time when the generated RRSIG records
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews expire. As with <code class="option">start-time</code>, an absolute
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews to the start time is indicated with +N, which is N seconds from
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews the start time. A time relative to the current time is
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews indicated with now+N. If no <code class="option">end-time</code> is
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein specified, 30 days from the start time is used as a default.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews <code class="option">end-time</code> must be later than
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt>
45e1bd63587102c3bb361eaca42ee7b714fb3542Mark Andrews Specify the date and time when the generated RRSIG records
29daf5bc7738f1cdab7914562269e1129c81acdcBrian Wellington for the DNSKEY RRset will expire. This is to be used in cases
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein when the DNSKEY signatures need to persist longer than
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington signatures on other records; e.g., when the private component
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews of the KSK is kept offline and the KSK signature is to be
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews refreshed manually.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein As with <code class="option">start-time</code>, an absolute
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein time is indicated in YYYYMMDDHHMMSS notation. A time relative
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews to the start time is indicated with +N, which is N seconds from
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews the start time. A time relative to the current time is
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein indicated with now+N. If no <code class="option">extended end-time</code> is
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews specified, the value of <code class="option">end-time</code> is used as
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews the default. (<code class="option">end-time</code>, in turn, defaults to
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein 30 days from the start time.) <code class="option">extended end-time</code>
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews must be later than <code class="option">start-time</code>.
45e1bd63587102c3bb361eaca42ee7b714fb3542Mark Andrews<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein The name of the output file containing the signed zone. The
4d180bd2100d9c848831c08e7f08a75cc21a9c0aBrian Wellington default is to append <code class="filename">.signed</code> to
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington the input filename. If <code class="option">output-file</code> is
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews set to <code class="literal">"-"</code>, then the signed zone is
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews written to the standard output, with a default output
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein format of "full".
4d180bd2100d9c848831c08e7f08a75cc21a9c0aBrian Wellington Prints a short summary of the options and arguments to
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span><strong class="command">dnssec-signzone</strong></span>.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
c1e7aff941dbf40090fec49300e728ad017d4f0cMark Andrews When a previously-signed zone is passed as input, records
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews may be resigned. The <code class="option">interval</code> option
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein specifies the cycle interval as an offset from the current
575737b964590103f60542849d4536b5ccd4eb3cBrian Wellington time (in seconds). If a RRSIG record expires after the
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews cycle interval, it is retained. Otherwise, it is considered
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews to be expiring soon, and it will be replaced.
52637f592f705ca93fadc218e403fd55e8ce4aeaMark Andrews The default cycle interval is one quarter of the difference
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews between the signature end and start times. So if neither
942d1a339b1fe617f7d17d66cb5fccce798d15aeBrian Wellington <code class="option">end-time</code> or <code class="option">start-time</code>
942d1a339b1fe617f7d17d66cb5fccce798d15aeBrian Wellington are specified, <span><strong class="command">dnssec-signzone</strong></span>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein signatures that are valid for 30 days, with a cycle
6a8832f784bd53aa6afbda22f6187cea6490e1e1Andreas Gustafsson interval of 7.5 days. Therefore, if any existing RRSIG records
942d1a339b1fe617f7d17d66cb5fccce798d15aeBrian Wellington are due to expire in less than 7.5 days, they would be
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews The format of the input zone file.
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews Possible formats are <span><strong class="command">"text"</strong></span> (default),
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews <span><strong class="command">"raw"</strong></span>, and <span><strong class="command">"map"</strong></span>.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein This option is primarily intended to be used for dynamic
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews signed zones so that the dumped zone file in a non-text
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews format containing updates can be signed directly.
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews The use of this option does not make much sense for
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein non-dynamic zones.
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews When signing a zone with a fixed signature lifetime, all
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein RRSIG records issued at the time of signing expires
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews simultaneously. If the zone is incrementally signed, i.e.
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews a previously-signed zone is passed as input to the signer,
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews all expired signatures have to be regenerated at about the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein same time. The <code class="option">jitter</code> option specifies a
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews jitter window that will be used to randomize the signature
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews expire time, thus spreading incremental signature
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews regeneration over time.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein Signature lifetime jitter also to some extent benefits
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews validators and servers by spreading out cache expiration,
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews i.e. if large numbers of RRSIGs don't expire at the same time
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews from all caches there will be less congestion than if all
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein validators need to refetch at mostly the same time.
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews<dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews When writing a signed zone to "raw" or "map" format, set the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein "source serial" value in the header to the specified serial
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews number. (This is expected to be used primarily for testing
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews Specifies the number of threads to use. By default, one
942d1a339b1fe617f7d17d66cb5fccce798d15aeBrian Wellington thread is started for each detected CPU.
1ef8965366d91e02a4672c35a187d30aa4a4c72cMark Andrews<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews The SOA serial number format of the signed zone.
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews Possible formats are <span><strong class="command">"keep"</strong></span> (default),
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span><strong class="command">"increment"</strong></span>, <span><strong class="command">"unixtime"</strong></span>,
d0221bfa6a08f7b284b231886928aa5d8ac87fc2Mark Andrews and <span><strong class="command">"date"</strong></span>.
904a5734375869ffb504ed8cde6b68cafadb6d64Bob Halley<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt>
985687b4e080182c1a3a2173df02b94a5b78b24fBob Halley<dd><p>Do not modify the SOA serial number.</p></dd>
and <span><strong class="command">"map"</strong></span>, <span><strong class="command">"raw"</strong></span>,
Kexample.com.+003+17247