127 lines
4.6 KiB
Plaintext
127 lines
4.6 KiB
Plaintext
.\" Man page generated from reStructuredText.
|
|
.
|
|
.TH "DNSSEC-IMPORTKEY" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9"
|
|
.SH NAME
|
|
dnssec-importkey \- import DNSKEY records from external systems so they can be managed
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.SH SYNOPSIS
|
|
.sp
|
|
\fBdnssec\-importkey\fP [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-h\fP] [\fB\-v\fP level] [\fB\-V\fP] {keyfile}
|
|
.sp
|
|
\fBdnssec\-importkey\fP {\fB\-f\fP filename} [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-h\fP] [\fB\-v\fP level] [\fB\-V\fP] [dnsname]
|
|
.SH DESCRIPTION
|
|
.sp
|
|
\fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair
|
|
of .key/.private files. The DNSKEY record may be read from an existing
|
|
\&.key file, in which case a corresponding .private file will be
|
|
generated, or it may be read from any other file or from the standard
|
|
input, in which case both .key and .private files will be generated.
|
|
.sp
|
|
The newly\-created .private file does \fInot\fP contain private key data, and
|
|
cannot be used for signing. However, having a .private file makes it
|
|
possible to set publication (\fB\-P\fP) and deletion (\fB\-D\fP) times for the
|
|
key, which means the public key can be added to and removed from the
|
|
DNSKEY RRset on schedule even if the true private key is stored offline.
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-f\fP filename
|
|
Zone file mode: instead of a public keyfile name, the argument is the
|
|
DNS domain name of a zone master file, which can be read from
|
|
\fBfile\fP\&. If the domain name is the same as \fBfile\fP, then it may be
|
|
omitted.
|
|
.sp
|
|
If \fBfile\fP is set to \fB"\-"\fP, then the zone data is read from the
|
|
standard input.
|
|
.TP
|
|
\fB\-K\fP directory
|
|
Sets the directory in which the key files are to reside.
|
|
.TP
|
|
\fB\-L\fP ttl
|
|
Sets the default TTL to use for this key when it is converted into a
|
|
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
|
will be used for it, unless there was already a DNSKEY RRset in
|
|
place, in which case the existing TTL would take precedence. Setting
|
|
the default TTL to \fB0\fP or \fBnone\fP removes it.
|
|
.TP
|
|
\fB\-h\fP
|
|
Emit usage message and exit.
|
|
.TP
|
|
\fB\-v\fP level
|
|
Sets the debugging level.
|
|
.TP
|
|
\fB\-V\fP
|
|
Prints version information.
|
|
.UNINDENT
|
|
.SH TIMING OPTIONS
|
|
.sp
|
|
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
|
argument begins with a \(aq+\(aq or \(aq\-\(aq, it is interpreted as an offset from
|
|
the present time. For convenience, if such an offset is followed by one
|
|
of the suffixes \(aqy\(aq, \(aqmo\(aq, \(aqw\(aq, \(aqd\(aq, \(aqh\(aq, or \(aqmi\(aq, then the offset is
|
|
computed in years (defined as 365 24\-hour days, ignoring leap years),
|
|
months (defined as 30 24\-hour days), weeks, days, hours, or minutes,
|
|
respectively. Without a suffix, the offset is computed in seconds. To
|
|
explicitly prevent a date from being set, use \(aqnone\(aq or \(aqnever\(aq.
|
|
.INDENT 0.0
|
|
.TP
|
|
\fB\-P\fP date/offset
|
|
Sets the date on which a key is to be published to the zone. After
|
|
that date, the key will be included in the zone but will not be used
|
|
to sign it.
|
|
.TP
|
|
\fB\-P\fP sync date/offset
|
|
Sets the date on which CDS and CDNSKEY records that match this key
|
|
are to be published to the zone.
|
|
.TP
|
|
\fB\-D\fP date/offset
|
|
Sets the date on which the key is to be deleted. After that date, the
|
|
key will no longer be included in the zone. (It may remain in the key
|
|
repository, however.)
|
|
.TP
|
|
\fB\-D\fP sync date/offset
|
|
Sets the date on which the CDS and CDNSKEY records that match this
|
|
key are to be deleted.
|
|
.UNINDENT
|
|
.SH FILES
|
|
.sp
|
|
A keyfile can be designed by the key identification \fBKnnnn.+aaa+iiiii\fP
|
|
or the full file name \fBKnnnn.+aaa+iiiii.key\fP as generated by
|
|
dnssec\-keygen8.
|
|
.SH SEE ALSO
|
|
.sp
|
|
\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
|
|
\fI\%RFC 5011\fP\&.
|
|
.SH AUTHOR
|
|
Internet Systems Consortium
|
|
.SH COPYRIGHT
|
|
2020, Internet Systems Consortium
|
|
.\" Generated by docutils manpage writer.
|
|
.
|