contrib/bind-9.2.4rc7/bin/dnssec/dnssec-signkey.html

   1 <!--
   2  - Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
   3  - Copyright (C) 2001, 2003  Internet Software Consortium.
   4  -
   5  - Permission to use, copy, modify, and distribute this software for any
   6  - purpose with or without fee is hereby granted, provided that the above
   7  - copyright notice and this permission notice appear in all copies.
   8  -
   9  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11  - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12  - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13  - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15  - PERFORMANCE OF THIS SOFTWARE.
  16 -->
  17
  18 <!-- $Id: dnssec-signkey.html,v 1.4.2.3 2004/06/03 05:21:11 marka Exp $ -->
  19
  20 <HTML
  21 ><HEAD
  22 ><TITLE
  23 >dnssec-signkey</TITLE
  24 ><META
  25 NAME="GENERATOR"
  26 CONTENT="Modular DocBook HTML Stylesheet Version 1.73
  27 "></HEAD
  28 ><BODY
  29 CLASS="REFENTRY"
  30 BGCOLOR="#FFFFFF"
  31 TEXT="#000000"
  32 LINK="#0000FF"
  33 VLINK="#840084"
  34 ALINK="#0000FF"
  35 ><H1
  36 ><A
  37 NAME="AEN1"
  38 ><SPAN
  39 CLASS="APPLICATION"
  40 >dnssec-signkey</SPAN
  41 ></A
  42 ></H1
  43 ><DIV
  44 CLASS="REFNAMEDIV"
  45 ><A
  46 NAME="AEN9"
  47 ></A
  48 ><H2
  49 >Name</H2
  50 ><SPAN
  51 CLASS="APPLICATION"
  52 >dnssec-signkey</SPAN
  53 >&nbsp;--&nbsp;DNSSEC key set signing tool</DIV
  54 ><DIV
  55 CLASS="REFSYNOPSISDIV"
  56 ><A
  57 NAME="AEN13"
  58 ></A
  59 ><H2
  60 >Synopsis</H2
  61 ><P
  62 ><B
  63 CLASS="COMMAND"
  64 >dnssec-signkey</B
  65 >  [<TT
  66 CLASS="OPTION"
  67 >-a</TT
  68 >] [<TT
  69 CLASS="OPTION"
  70 >-c <TT
  71 CLASS="REPLACEABLE"
  72 ><I
  73 >class</I
  74 ></TT
  75 ></TT
  76 >] [<TT
  77 CLASS="OPTION"
  78 >-s <TT
  79 CLASS="REPLACEABLE"
  80 ><I
  81 >start-time</I
  82 ></TT
  83 ></TT
  84 >] [<TT
  85 CLASS="OPTION"
  86 >-e <TT
  87 CLASS="REPLACEABLE"
  88 ><I
  89 >end-time</I
  90 ></TT
  91 ></TT
  92 >] [<TT
  93 CLASS="OPTION"
  94 >-h</TT
  95 >] [<TT
  96 CLASS="OPTION"
  97 >-p</TT
  98 >] [<TT
  99 CLASS="OPTION"
 100 >-r <TT
 101 CLASS="REPLACEABLE"
 102 ><I
 103 >randomdev</I
 104 ></TT
 105 ></TT
 106 >] [<TT
 107 CLASS="OPTION"
 108 >-v <TT
 109 CLASS="REPLACEABLE"
 110 ><I
 111 >level</I
 112 ></TT
 113 ></TT
 114 >] {keyset} {key...}</P
 115 ></DIV
 116 ><DIV
 117 CLASS="REFSECT1"
 118 ><A
 119 NAME="AEN39"
 120 ></A
 121 ><H2
 122 >DESCRIPTION</H2
 123 ><P
 124 >        <B
 125 CLASS="COMMAND"
 126 >dnssec-signkey</B
 127 > signs a keyset.  Typically
 128         the keyset will be for a child zone, and will have been generated
 129         by <B
 130 CLASS="COMMAND"
 131 >dnssec-makekeyset</B
 132 >.  The child zone's keyset
 133         is signed with the zone keys for its parent zone.  The output file
 134         is of the form <TT
 135 CLASS="FILENAME"
 136 >signedkey-nnnn.</TT
 137 >, where
 138         <TT
 139 CLASS="FILENAME"
 140 >nnnn</TT
 141 > is the zone name.
 142     </P
 143 ></DIV
 144 ><DIV
 145 CLASS="REFSECT1"
 146 ><A
 147 NAME="AEN46"
 148 ></A
 149 ><H2
 150 >OPTIONS</H2
 151 ><P
 152 ></P
 153 ><DIV
 154 CLASS="VARIABLELIST"
 155 ><DL
 156 ><DT
 157 >-a</DT
 158 ><DD
 159 ><P
 160 >             Verify all generated signatures.
 161           </P
 162 ></DD
 163 ><DT
 164 >-c <TT
 165 CLASS="REPLACEABLE"
 166 ><I
 167 >class</I
 168 ></TT
 169 ></DT
 170 ><DD
 171 ><P
 172 >              Specifies the DNS class of the key sets.
 173           </P
 174 ></DD
 175 ><DT
 176 >-s <TT
 177 CLASS="REPLACEABLE"
 178 ><I
 179 >start-time</I
 180 ></TT
 181 ></DT
 182 ><DD
 183 ><P
 184 >              Specify the date and time when the generated SIG records
 185                become valid.  This can be either an absolute or relative
 186                time.  An absolute start time is indicated by a number
 187                in YYYYMMDDHHMMSS notation; 20000530144500 denotes
 188                14:45:00 UTC on May 30th, 2000.  A relative start time is
 189                indicated by +N, which is N seconds from the current time.
 190                If no <TT
 191 CLASS="OPTION"
 192 >start-time</TT
 193 > is specified, the current
 194                time is used.
 195           </P
 196 ></DD
 197 ><DT
 198 >-e <TT
 199 CLASS="REPLACEABLE"
 200 ><I
 201 >end-time</I
 202 ></TT
 203 ></DT
 204 ><DD
 205 ><P
 206 >              Specify the date and time when the generated SIG records
 207                expire.  As with <TT
 208 CLASS="OPTION"
 209 >start-time</TT
 210 >, an absolute
 211                time is indicated in YYYYMMDDHHMMSS notation.  A time relative
 212                to the start time is indicated with +N, which is N seconds from
 213                the start time.  A time relative to the current time is
 214                indicated with now+N.  If no <TT
 215 CLASS="OPTION"
 216 >end-time</TT
 217 > is
 218                specified, 30 days from the start time is used as a default.
 219           </P
 220 ></DD
 221 ><DT
 222 >-h</DT
 223 ><DD
 224 ><P
 225 >              Prints a short summary of the options and arguments to
 226                <B
 227 CLASS="COMMAND"
 228 >dnssec-signkey</B
 229 >.
 230           </P
 231 ></DD
 232 ><DT
 233 >-p</DT
 234 ><DD
 235 ><P
 236 >              Use pseudo-random data when signing the zone.  This is faster,
 237                but less secure, than using real random data.  This option
 238                may be useful when signing large zones or when the entropy
 239                source is limited.
 240           </P
 241 ></DD
 242 ><DT
 243 >-r <TT
 244 CLASS="REPLACEABLE"
 245 ><I
 246 >randomdev</I
 247 ></TT
 248 ></DT
 249 ><DD
 250 ><P
 251 >              Specifies the source of randomness.  If the operating
 252                system does not provide a <TT
 253 CLASS="FILENAME"
 254 >/dev/random</TT
 255 >
 256                or equivalent device, the default source of randomness
 257                is keyboard input.  <TT
 258 CLASS="FILENAME"
 259 >randomdev</TT
 260 > specifies
 261                the name of a character device or file containing random
 262                data to be used instead of the default.  The special value
 263                <TT
 264 CLASS="FILENAME"
 265 >keyboard</TT
 266 > indicates that keyboard
 267                input should be used.
 268           </P
 269 ></DD
 270 ><DT
 271 >-v <TT
 272 CLASS="REPLACEABLE"
 273 ><I
 274 >level</I
 275 ></TT
 276 ></DT
 277 ><DD
 278 ><P
 279 >              Sets the debugging level.
 280           </P
 281 ></DD
 282 ><DT
 283 >keyset</DT
 284 ><DD
 285 ><P
 286 >               The file containing the child's keyset.
 287           </P
 288 ></DD
 289 ><DT
 290 >key</DT
 291 ><DD
 292 ><P
 293 >               The keys used to sign the child's keyset.
 294           </P
 295 ></DD
 296 ></DL
 297 ></DIV
 298 ></DIV
 299 ><DIV
 300 CLASS="REFSECT1"
 301 ><A
 302 NAME="AEN101"
 303 ></A
 304 ><H2
 305 >EXAMPLE</H2
 306 ><P
 307 >        The DNS administrator for a DNSSEC-aware <TT
 308 CLASS="USERINPUT"
 309 ><B
 310 >.com</B
 311 ></TT
 312 >
 313         zone would use the following command to sign the
 314         <TT
 315 CLASS="FILENAME"
 316 >keyset</TT
 317 > file for <TT
 318 CLASS="USERINPUT"
 319 ><B
 320 >example.com</B
 321 ></TT
 322 >
 323         created by <B
 324 CLASS="COMMAND"
 325 >dnssec-makekeyset</B
 326 > with a key generated
 327         by <B
 328 CLASS="COMMAND"
 329 >dnssec-keygen</B
 330 >:
 331     </P
 332 ><P
 333 >        <TT
 334 CLASS="USERINPUT"
 335 ><B
 336 >dnssec-signkey keyset-example.com. Kcom.+003+51944</B
 337 ></TT
 338 >
 339     </P
 340 ><P
 341 >        In this example, <B
 342 CLASS="COMMAND"
 343 >dnssec-signkey</B
 344 > creates
 345         the file <TT
 346 CLASS="FILENAME"
 347 >signedkey-example.com.</TT
 348 >, which
 349         contains the <TT
 350 CLASS="USERINPUT"
 351 ><B
 352 >example.com</B
 353 ></TT
 354 > keys and the
 355         signatures by the <TT
 356 CLASS="USERINPUT"
 357 ><B
 358 >.com</B
 359 ></TT
 360 > keys.
 361     </P
 362 ></DIV
 363 ><DIV
 364 CLASS="REFSECT1"
 365 ><A
 366 NAME="AEN116"
 367 ></A
 368 ><H2
 369 >SEE ALSO</H2
 370 ><P
 371 >      <SPAN
 372 CLASS="CITEREFENTRY"
 373 ><SPAN
 374 CLASS="REFENTRYTITLE"
 375 >dnssec-keygen</SPAN
 376 >(8)</SPAN
 377 >,
 378       <SPAN
 379 CLASS="CITEREFENTRY"
 380 ><SPAN
 381 CLASS="REFENTRYTITLE"
 382 >dnssec-makekeyset</SPAN
 383 >(8)</SPAN
 384 >,
 385       <SPAN
 386 CLASS="CITEREFENTRY"
 387 ><SPAN
 388 CLASS="REFENTRYTITLE"
 389 >dnssec-signzone</SPAN
 390 >(8)</SPAN
 391 >.
 392     </P
 393 ></DIV
 394 ><DIV
 395 CLASS="REFSECT1"
 396 ><A
 397 NAME="AEN128"
 398 ></A
 399 ><H2
 400 >AUTHOR</H2
 401 ><P
 402 >        Internet Systems Consortium
 403     </P
 404 ></DIV
 405 ></BODY
 406 ></HTML
 407 >