src - FreeBSD source tree

diff options


context:
space:
mode:

author	Doug Barton <dougb@FreeBSD.org>	2011-07-16 11:12:09 +0000
committer	Doug Barton <dougb@FreeBSD.org>	2011-07-16 11:12:09 +0000
commit	7afecc12f4d7b56f03438d5f41b837b9696f0a94 (patch)
tree	7873e6a2dac5f9ddbfefa3b07f3cf0570f682321 /contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
parent	a9285ae5c428d2017b1b907b8403ebe30f369bec (diff)
parent	473038528ab5bd55332138ebf791ab91a25f747b (diff)

Upgrade to version 9.8.0-P4

This version has many new features, see /usr/share/doc/bind9/README for details.

Notes

Notes: svn path=/head/; revision=224092

Diffstat (limited to 'contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html')

-rw-r--r--

contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html

136

1 files changed, 112 insertions, 24 deletions

diff --git a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
index ad2a5621ba99..2b1b23690bb1 100644
--- a/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html
+++ b/contrib/bind9/bin/dnssec/dnssec-keyfromlabel.html

@@ -1,5 +1,5 @@

<!--

- Permission to use, copy, modify, and/or distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

@@ -13,7 +13,7 @@

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

<html>

<head>

@@ -28,26 +28,30 @@

</div>

<h2>Synopsis</h2>

-<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-k</code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>

+<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div>

</div>

-<a name="id2543416"></a><h2>DESCRIPTION</h2>

+<a name="id2543494"></a><h2>DESCRIPTION</h2>

<p><span><strong class="command">dnssec-keyfromlabel</strong></span>

gets keys with the given label from a crypto hardware and builds

key files for DNSSEC (Secure DNS), as defined in RFC 2535

and RFC 4034.

</p>

+<p>

+ The <code class="option">name</code> of the key is specified on the command

+ line. This must match the name of the zone for which the key is

+ being generated.

+ </p>

</div>

-<a name="id2543428"></a><h2>OPTIONS</h2>

+<a name="id2543512"></a><h2>OPTIONS</h2>

<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>

<dd>

<p>

Selects the cryptographic algorithm. The value of

- <code class="option">algorithm</code> must be one of RSAMD5,

- RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256,

- RSASHA512 or DH (Diffie Hellman).

+ <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,

+ DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512 or ECCGOST.

These values are case insensitive.

</p>

<p>

@@ -65,10 +69,23 @@

Note 2: DH automatically sets the -k flag.

</p>

</dd>

+<dt><span class="term">-3</span></dt>

+<dd><p>

+ Use an NSEC3-capable algorithm to generate a DNSSEC key.

+ If this option is used and no algorithm is explicitly

+ set on the command line, NSEC3RSASHA1 will be used by

+ default.

+ </p></dd>

+<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>

+<dd><p>

+ Specifies the name of the crypto hardware (OpenSSL engine).

+ When compiled with PKCS#11 support it defaults to "pkcs11".

+ </p></dd>

<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>

<dd><p>

- Specifies the label of keys in the crypto hardware

- (PKCS#11 device).

+ Specifies the label of the key pair in the crypto hardware.

+ The label may be preceded by an optional OpenSSL engine name,

+ separated by a colon, as in "pkcs11:keylabel".

</p></dd>

<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>

<dd><p>

@@ -77,8 +94,17 @@

zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with

a host (KEY)),

USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).

- These values are

- case insensitive.

+ These values are case insensitive.

+ </p></dd>

+<dt><span class="term">-C</span></dt>

+<dd><p>

+ Compatibility mode: generates an old-style key, without

+ any metadata. By default, <span><strong class="command">dnssec-keyfromlabel</strong></span>

+ will include the key's creation date in the metadata stored

+ with the private key, and other dates may be set there as well

+ (publication date, activation date, etc). Keys that include

+ this data may be incompatible with older versions of BIND; the

+ <code class="option">-C</code> option suppresses them.

</p></dd>

<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>

<dd><p>

@@ -88,12 +114,21 @@

<dd><p>

Set the specified flag in the flag field of the KEY/DNSKEY record.

- The only recognized flag is KSK (Key Signing Key) DNSKEY.

+ The only recognized flags are KSK (Key Signing Key) and REVOKE.

+ </p></dd>

+<dt><span class="term">-G</span></dt>

+<dd><p>

+ Generate a key, but do not publish it or sign with it. This

+ option is incompatible with -P and -A.

</p></dd>

<dd><p>

Prints a short summary of the options and arguments to

- <span><strong class="command">dnssec-keygen</strong></span>.

+ <span><strong class="command">dnssec-keyfromlabel</strong></span>.

+ </p></dd>

+<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>

+<dd><p>

+ Sets the directory in which the key files are to be written.

</p></dd>

<dd><p>

@@ -101,7 +136,7 @@

</p></dd>

<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>

<dd><p>

- Sets the protocol value for the generated key. The protocol

+ Sets the protocol value for the key. The protocol

is a number between 0 and 255. The default is 3 (DNSSEC).

Other possible values for this argument are listed in

RFC 2535 and its successors.

@@ -117,10 +152,65 @@

<dd><p>

Sets the debugging level.

</p></dd>

+<dt><span class="term">-y</span></dt>

+<dd><p>

+ Allows DNSSEC key files to be generated even if the key ID

+ would collide with that of an existing key, in the event of

+ either key being revoked. (This is only safe to use if you

+ are sure you won't be using RFC 5011 trust anchor maintenance

+ with either of the keys involved.)

+ </p></dd>

+</dl></div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2543876"></a><h2>TIMING OPTIONS</h2>

+<p>

+ Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.

+ If the argument begins with a '+' or '-', it is interpreted as

+ an offset from the present time. For convenience, if such an offset

+ is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',

+ then the offset is computed in years (defined as 365 24-hour days,

+ ignoring leap years), months (defined as 30 24-hour days), weeks,

+ days, hours, or minutes, respectively. Without a suffix, the offset

+ is computed in seconds.

+ </p>

+<div class="variablelist"><dl>

+<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>

+<dd><p>

+ Sets the date on which a key is to be published to the zone.

+ After that date, the key will be included in the zone but will

+ not be used to sign it. If not set, and if the -G option has

+ not been used, the default is "now".

+ </p></dd>

+<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>

+<dd><p>

+ Sets the date on which the key is to be activated. After that

+ date, the key will be included in the zone and used to sign

+ it. If not set, and if the -G option has not been used, the

+ default is "now".

+ </p></dd>

+<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>

+<dd><p>

+ Sets the date on which the key is to be revoked. After that

+ date, the key will be flagged as revoked. It will be included

+ in the zone and will be used to sign it.

+ </p></dd>

+<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>

+<dd><p>

+ Sets the date on which the key is to be retired. After that

+ date, the key will still be included in the zone, but it

+ will not be used to sign it.

+ </p></dd>

+<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>

+<dd><p>

+ Sets the date on which the key is to be deleted. After that

+ date, the key will no longer be included in the zone. (It

+ may remain in the key repository, however.)

+ </p></dd>

</dl></div>

</div>

-<a name="id2543632"></a><h2>GENERATED KEY FILES</h2>

+<a name="id2544042"></a><h2>GENERATED KEY FILES</h2>

<p>

When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes

successfully,

@@ -132,8 +222,7 @@

<li><p><code class="filename">nnnn</code> is the key name.

</p></li>

<li><p><code class="filename">aaa</code> is the numeric representation

- of the

- algorithm.

+ of the algorithm.

</p></li>

<li><p><code class="filename">iiiii</code> is the key identifier (or

footprint).

@@ -144,8 +233,7 @@

on the printed string. <code class="filename">Knnnn.+aaa+iiiii.key</code>

contains the public key, and

<code class="filename">Knnnn.+aaa+iiiii.private</code> contains the

- private

- key.

+ private key.

</p>

<p>

The <code class="filename">.key</code> file contains a DNS KEY record

@@ -154,14 +242,14 @@

statement).

</p>

<p>

- The <code class="filename">.private</code> file contains algorithm

- specific

+ The <code class="filename">.private</code> file contains

+ algorithm-specific

fields. For obvious security reasons, this file does not have

general read permission.

</p>

</div>

-<a name="id2543704"></a><h2>SEE ALSO</h2>

+<a name="id2544115"></a><h2>SEE ALSO</h2>

<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,

<em class="citetitle">BIND 9 Administrator Reference Manual</em>,

@@ -169,7 +257,7 @@

</p>

</div>

-<a name="id2543737"></a><h2>AUTHOR</h2>

+<a name="id2544148"></a><h2>AUTHOR</h2>

<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>