Indicates that the DNS record containing the key should have the specified class\&. If not specified, class IN is used\&.
.RE
.PP
\-d \fIbits\fR
.RS 4
Key size in bits\&. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256 and RSASHA512 the key size must be in range 1024\-4096\&. DH size is between 128 and 4096\&. This option is ignored for algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448\&.
.RE
.PP
\-E \fIengine\fR
.RS 4
Specifies the cryptographic hardware to use, when applicable\&.
...
...
@@ -142,6 +147,17 @@ Prints a short summary of the options and arguments to
Sets the directory in which the key files are to be written\&.
.RE
.PP
\-k \fIpolicy\fR
.RS 4
Create keys for a specific dnssec\-policy\&. If a policy uses multiple keys,
\fBdnssec\-keygen\fR
will generate multiple keys\&. This will also create a "\&.state" file to keep track of the key state\&.
.sp
This option creates keys according to the dnssec\-policy configuration, hence it cannot be used together with many of the other options that
\fBdnssec\-keygen\fR
provides\&.
.RE
.PP
\-L \fIttl\fR
.RS 4
Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to
...
...
@@ -151,6 +167,12 @@ none
is the same as leaving it unset\&.
.RE
.PP
\-l \fIfile\fR
.RS 4
Provide a configuration file that contains a dnssec\-policy statement (matching the policy set with
\fB\-k\fR)\&.
.RE
.PP
\-n \fInametype\fR
.RS 4
Specifies the owner type of the key\&. The value of
@@ -59,7 +59,25 @@ simply prints the key timing metadata already stored in the key\&.
.PP
When key metadata fields are changed, both files of a key pair (Knnnn\&.+aaa+iiiii\&.key
and
Knnnn\&.+aaa+iiiii\&.private) are regenerated\&. Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
Knnnn\&.+aaa+iiiii\&.private) are regenerated\&.
.PP
Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
.PP
When working with state files, it is possible to update the timing metadata in those files as well with
\fB\-s\fR\&. If this option is used you can also update key states with
\fB\-d\fR
(DS),
\fB\-k\fR
(DNSKEY),
\fB\-r\fR
(RRSIG of KSK), or
\fB\-z\fR
(RRSIG of ZSK)\&. Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE\&.
.PP
You can also set the goal state of the key with
\fB\-g\fR\&. This should be either HIDDEN or OMNIPRESENT (representing whether the key should be removed from the zone, or published)\&.
.PP
It is NOT RECOMMENDED to manipulate state files manually except for testing purposes\&.
.SH "OPTIONS"
.PP
\-f
...
...
@@ -156,6 +174,39 @@ If the key is being set to be an explicit successor to another key, then the def
.sp
As with date offsets, if the argument is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the interval is measured in years, months, weeks, days, hours, or minutes, respectively\&. Without a suffix, the interval is measured in seconds\&.
.RE
.SH "KEY STATE OPTIONS"
.PP
Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE\&. These should not be set manually except for testing purposes\&.
.PP
\-s
.RS 4
When setting key timing data, also update the state file\&.
.RE
.PP
\-g
.RS 4
Set the goal state for this key\&. Must be HIDDEN or OMNIPRESENT\&.
.RE
.PP
\-d
.RS 4
Set the DS state for this key, and when it was last changed\&.
.RE
.PP
\-k
.RS 4
Set the DNSKEY state for this key, and when it was last changed\&.
.RE
.PP
\-r
.RS 4
Set the RRSIG (KSK) state for this key, and when it was last changed\&.
.RE
.PP
\-z
.RS 4
Set the RRSIG (ZSK) state for this key, and when it was last changed\&.
