Skip to content

GitLab

BIND
BIND
Switch branch/tag
Find file Normal viewHistoryPermalink
dnssec-settime.html 12.7 KB
Newer Older
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
1 
<!--
Tinderbox User's avatar
regen master  
Tinderbox User committed
2 
 - Copyright (C) 2009-2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
3 
 -
Automatic Updater's avatar
regen  
Automatic Updater committed
4 
 - Permission to use, copy, modify, and/or distribute this software for any
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
5 6 
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
7 
 -
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
8 9 
 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
10 
 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
11 12 13 14 15 16 17 18 
 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
-->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
Automatic Updater's avatar
regen  
Automatic Updater committed
19 
<title>dnssec-settime</title>
Tinderbox User's avatar
regen master  
Tinderbox User committed
20 
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
21 
</head>
Tinderbox User's avatar
regen master  
Tinderbox User committed
22 
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
23 
<a name="man.dnssec-settime"></a><div class="titlepage"></div>
Tinderbox User's avatar
regen master  
Tinderbox User committed
24 
<div class="refnamediv">
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
25 
<h2>Name</h2>
Tinderbox User's avatar
regen master  
Tinderbox User committed
26 
<p><span class="application">dnssec-settime</span> &#8212; set the key timing metadata for a DNSSEC key</p>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
27 
</div>
Tinderbox User's avatar
regen master  
Tinderbox User committed
28 
<div class="refsynopsisdiv">
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
29 
<h2>Synopsis</h2>
Tinderbox User's avatar
regen master  
Tinderbox User committed
30 
<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
Tinderbox User's avatar
regen master  
Tinderbox User committed
31 32 33 34 
</div>
<div class="refsection">
<a name="id-1.7"></a><h2>DESCRIPTION</h2>
<p><span class="command"><strong>dnssec-settime</strong></span>
Automatic Updater's avatar
regen  
Automatic Updater committed
35 
      reads a DNSSEC private key file and sets the key timing metadata
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
36 
      as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
Automatic Updater's avatar
regen  
Automatic Updater committed
37 
      <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
Automatic Updater's avatar
regen  
Automatic Updater committed
38 
      options.  The metadata can then be used by
Tinderbox User's avatar
regen master  
Tinderbox User committed
39 
      <span class="command"><strong>dnssec-signzone</strong></span> or other signing software to
Automatic Updater's avatar
regen  
Automatic Updater committed
40 41 
      determine when a key is to be published, whether it should be
      used for signing a zone, etc.
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
42 
    </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
43 
<p>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
44 
      If none of these options is set on the command line,
Tinderbox User's avatar
regen master  
Tinderbox User committed
45 
      then <span class="command"><strong>dnssec-settime</strong></span> simply prints the key timing
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
46 47 
      metadata already stored in the key.
    </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
48 
<p>
Automatic Updater's avatar
regen  
Automatic Updater committed
49 50 51 52 53 
      When key metadata fields are changed, both files of a key
      pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
      <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
      Metadata fields are stored in the private file.  A human-readable
      description of the metadata is also placed in comments in the key
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
54 55 
      file.  The private file's permissions are always set to be
      inaccessible to anyone other than the owner (mode 0600).
Automatic Updater's avatar
regen  
Automatic Updater committed
56 
    </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
57 58 59 60 
</div>
<div class="refsection">
<a name="id-1.8"></a><h2>OPTIONS</h2>
<div class="variablelist"><dl class="variablelist">
Automatic Updater's avatar
regen  
Automatic Updater committed
61 
<dt><span class="term">-f</span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
62 
<dd><p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
63 
            Force an update of an old-format key with no metadata fields.
Tinderbox User's avatar
regen master  
Tinderbox User committed
64 
            Without this option, <span class="command"><strong>dnssec-settime</strong></span> will
Automatic Updater's avatar
regen  
Automatic Updater committed
65 66 67 
            fail when attempting to update a legacy key.  With this option,
            the key will be recreated in the new format, but with the
            original key data retained.  The key's creation date will be
Tinderbox User's avatar
regen master  
Tinderbox User committed
68 69 
            set to the present time.  If no other values are specified,
            then the key's publication and activation dates will also
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
70 
            be set to the present time.
Tinderbox User's avatar
regen master  
Tinderbox User committed
71 
          </p></dd>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
72 
<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
73 
<dd><p>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
74 
            Sets the directory in which the key files are to reside.
Tinderbox User's avatar
regen master  
Tinderbox User committed
75 
          </p></dd>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
76 
<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
77 
<dd><p>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
78 79 80 81 
            Sets the default TTL to use for this key when it is converted
            into a DNSKEY RR.  If the key is imported into a zone,
            this is the TTL that will be used for it, unless there was
            already a DNSKEY RRset in place, in which case the existing TTL
Tinderbox User's avatar
regen master  
Tinderbox User committed
82 83 84 85 
            would take precedence.  If this value is not set and there
            is no existing DNSKEY RRset, the TTL will default to the
            SOA TTL. Setting the default TTL to <code class="literal">0</code>
            or <code class="literal">none</code> removes it from the key.
Tinderbox User's avatar
regen master  
Tinderbox User committed
86 
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
87 
<dt><span class="term">-h</span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
88 
<dd><p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
89 90 
            Emit usage message and exit.
          </p></dd>
Tinderbox User's avatar
regen master  
Tinderbox User committed
91 
<dt><span class="term">-V</span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
92 
<dd><p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
93 94 
            Prints version information.
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
95 
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
96 
<dd><p>
Automatic Updater's avatar
regen  
Automatic Updater committed
97 
            Sets the debugging level.
Tinderbox User's avatar
regen master  
Tinderbox User committed
98 
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
99 
<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
100 
<dd>
Tinderbox User's avatar
regen master  
Tinderbox User committed
101 
<p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
102 103 
            Specifies the cryptographic hardware to use, when applicable.
          </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
104 
<p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
105 106 107 108 109 110 111 
            When BIND is built with OpenSSL PKCS#11 support, this defaults
            to the string "pkcs11", which identifies an OpenSSL engine
            that can drive a cryptographic accelerator or hardware service
            module.  When BIND is built with native PKCS#11 cryptography
            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
            provider library specified via "--with-pkcs11".
          </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
112 
</dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
113 
</dl></div>
Tinderbox User's avatar
regen master  
Tinderbox User committed
114 115 116 117 
</div>
<div class="refsection">
<a name="id-1.9"></a><h2>TIMING OPTIONS</h2>
<p>
Automatic Updater's avatar
regen  
Automatic Updater committed
118 119 
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
Automatic Updater's avatar
regen  
Automatic Updater committed
120 121 122 123 124 
      an offset from the present time.  For convenience, if such an offset
      is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
      then the offset is computed in years (defined as 365 24-hour days,
      ignoring leap years), months (defined as 30 24-hour days), weeks,
      days, hours, or minutes, respectively.  Without a suffix, the offset
Tinderbox User's avatar
regen master  
Tinderbox User committed
125 
      is computed in seconds.  To unset a date, use 'none' or 'never'.
Automatic Updater's avatar
regen  
Automatic Updater committed
126 
    </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
127 
<div class="variablelist"><dl class="variablelist">
Automatic Updater's avatar
regen  
Automatic Updater committed
128 
<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
129 
<dd><p>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
130 131 132 
            Sets the date on which a key is to be published to the zone.
            After that date, the key will be included in the zone but will
            not be used to sign it.
Tinderbox User's avatar
regen master  
Tinderbox User committed
133 
          </p></dd>
Tinderbox User's avatar
regen master  
Tinderbox User committed
134 135 136 137 138 
<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
<dd><p>
            Sets the date on which CDS and CDNSKEY records that match this
            key are to be published to the zone.
          </p></dd>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
139 
<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
140 
<dd><p>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
141 
            Sets the date on which the key is to be activated.  After that
Automatic Updater's avatar
regen  
Automatic Updater committed
142 
            date, the key will be included in the zone and used to sign
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
143 
            it.
Tinderbox User's avatar
regen master  
Tinderbox User committed
144 
          </p></dd>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
145 
<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
146 
<dd><p>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
147 148 149 
            Sets the date on which the key is to be revoked.  After that
            date, the key will be flagged as revoked.  It will be included
            in the zone and will be used to sign it.
Tinderbox User's avatar
regen master  
Tinderbox User committed
150 
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
151 
<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
152 
<dd><p>
Automatic Updater's avatar
regen  
Automatic Updater committed
153 154 155 
            Sets the date on which the key is to be retired.  After that
            date, the key will still be included in the zone, but it
            will not be used to sign it.
Tinderbox User's avatar
regen master  
Tinderbox User committed
156 
          </p></dd>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
157 
<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
158 
<dd><p>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
159 
            Sets the date on which the key is to be deleted.  After that
Automatic Updater's avatar
regen  
Automatic Updater committed
160 161 
            date, the key will no longer be included in the zone.  (It
            may remain in the key repository, however.)
Tinderbox User's avatar
regen master  
Tinderbox User committed
162 
          </p></dd>
Tinderbox User's avatar
regen master  
Tinderbox User committed
163 164 165 166 167 
<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
<dd><p>
            Sets the date on which the CDS and CDNSKEY records that match this
            key are to be deleted.
          </p></dd>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
168 
<dt><span class="term">-S <em class="replaceable"><code>predecessor key</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
169 
<dd><p>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
170 171 172 173 174 175 176 
            Select a key for which the key being modified will be an
            explicit successor.  The name, algorithm, size, and type of the
            predecessor key must exactly match those of the key being
            modified.  The activation date of the successor key will be set
            to the inactivation date of the predecessor.  The publication
            date will be set to the activation date minus the prepublication
            interval, which defaults to 30 days.
Tinderbox User's avatar
regen master  
Tinderbox User committed
177 
          </p></dd>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
178 179 
<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
<dd>
Tinderbox User's avatar
regen master  
Tinderbox User committed
180 
<p>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
181 182 183 184 185 186 187 188 
            Sets the prepublication interval for a key.  If set, then
            the publication and activation dates must be separated by at least
            this much time.  If the activation date is specified but the
            publication date isn't, then the publication date will default
            to this much time before the activation date; conversely, if
            the publication date is specified but activation date isn't,
            then activation will be set to this much time after publication.
          </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
189 
<p>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
190 
            If the key is being set to be an explicit successor to another
Tinderbox User's avatar
regen master  
Tinderbox User committed
191 
            key, then the default prepublication interval is 30 days;
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
192 193 
            otherwise it is zero.
          </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
194 
<p>
Automatic Updater's avatar
regen HEAD  
Automatic Updater committed
195 196 197 198 199 200 
            As with date offsets, if the argument is followed by one of
            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
            interval is measured in years, months, weeks, days, hours,
            or minutes, respectively.  Without a suffix, the interval is
            measured in seconds.
          </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
201 
</dd>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
202 
</dl></div>
Tinderbox User's avatar
regen master  
Tinderbox User committed
203 204 205 206 
</div>
<div class="refsection">
<a name="id-1.10"></a><h2>PRINTING OPTIONS</h2>
<p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
207 
      <span class="command"><strong>dnssec-settime</strong></span> can also be used to print the
Automatic Updater's avatar
regen  
Automatic Updater committed
208 209 
      timing metadata associated with a key.
    </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
210 
<div class="variablelist"><dl class="variablelist">
Automatic Updater's avatar
regen  
Automatic Updater committed
211 
<dt><span class="term">-u</span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
212 
<dd><p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
213 214 215 
            Print times in UNIX epoch format.
          </p></dd>
<dt><span class="term">-p <em class="replaceable"><code>C/P/Psync/A/R/I/D/Dsync/all</code></em></span></dt>
Tinderbox User's avatar
regen master  
Tinderbox User committed
216 
<dd><p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
217 
            Print a specific metadata value or set of metadata values.
Automatic Updater's avatar
regen  
Automatic Updater committed
218 
            The <code class="option">-p</code> option may be followed by one or more
Tinderbox User's avatar
regen master  
Tinderbox User committed
219 220 
            of the following letters or strings to indicate which value
            or values to print:
Automatic Updater's avatar
regen  
Automatic Updater committed
221 222 
            <code class="option">C</code> for the creation date,
            <code class="option">P</code> for the publication date,
Tinderbox User's avatar
regen master  
Tinderbox User committed
223 
            <code class="option">Psync</code> for the CDS and CDNSKEY publication date,
Automatic Updater's avatar
regen  
Automatic Updater committed
224 
            <code class="option">A</code> for the activation date,
Automatic Updater's avatar
regen  
Automatic Updater committed
225 
            <code class="option">R</code> for the revocation date,
Tinderbox User's avatar
regen master  
Tinderbox User committed
226 227 228 
            <code class="option">I</code> for the inactivation date,
            <code class="option">D</code> for the deletion date, and
            <code class="option">Dsync</code> for the CDS and CDNSKEY deletion date
Automatic Updater's avatar
regen  
Automatic Updater committed
229 
            To print all of the metadata, use <code class="option">-p all</code>.
Tinderbox User's avatar
regen master  
Tinderbox User committed
230 
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
231 
</dl></div>
Tinderbox User's avatar
regen master  
Tinderbox User committed
232 233 234 235 236 
</div>
<div class="refsection">
<a name="id-1.11"></a><h2>SEE ALSO</h2>
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
237 238 239 
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 5011</em>.
    </p>
Tinderbox User's avatar
regen master  
Tinderbox User committed
240 
</div>
Evan Hunt's avatar
2636. [func] Simplify zone signing and key maintenance with the  
Evan Hunt committed
241 242 
</div></body>
</html>