man.dnssec-keyfromlabel.html 19.2 KB
Newer Older
Francis Dupont's avatar
Francis Dupont committed
1
<!--
Tinderbox User's avatar
Tinderbox User committed
2
 - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
Francis Dupont's avatar
Francis Dupont committed
3 4
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
Automatic Updater's avatar
regen  
Automatic Updater committed
5
 - Permission to use, copy, modify, and/or distribute this software for any
Francis Dupont's avatar
Francis Dupont committed
6 7 8 9 10 11 12 13 14 15 16
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 - 
 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
-->
Tinderbox User's avatar
Tinderbox User committed
17
<!-- $Id$ -->
Francis Dupont's avatar
Francis Dupont committed
18 19 20 21 22 23
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>dnssec-keyfromlabel</title>
<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
Tinderbox User's avatar
Tinderbox User committed
24
<link rel="up" href="Bv9ARM.ch13.html" title="Manual pages">
Tinderbox User's avatar
Tinderbox User committed
25
<link rel="prev" href="man.dnssec-importkey.html" title="dnssec-importkey">
Francis Dupont's avatar
Francis Dupont committed
26 27 28 29 30 31 32 33
<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<div class="navheader">
<table width="100%" summary="Navigation header">
<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
<tr>
<td width="20%" align="left">
Tinderbox User's avatar
Tinderbox User committed
34
<a accesskey="p" href="man.dnssec-importkey.html">Prev</a> </td>
Francis Dupont's avatar
Francis Dupont committed
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49
<th width="60%" align="center">Manual pages</th>
<td width="20%" align="right"> <a accesskey="n" href="man.dnssec-keygen.html">Next</a>
</td>
</tr>
</table>
<hr>
</div>
<div class="refentry" lang="en">
<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
<div class="refnamediv">
<h2>Name</h2>
<p><span class="application">dnssec-keyfromlabel</span> &#8212; DNSSEC key generation tool</p>
</div>
<div class="refsynopsisdiv">
<h2>Synopsis</h2>
Tinderbox User's avatar
Tinderbox User committed
50
<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
Francis Dupont's avatar
Francis Dupont committed
51 52
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
53
<a name="id2624571"></a><h2>DESCRIPTION</h2>
Francis Dupont's avatar
Francis Dupont committed
54
<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
Tinderbox User's avatar
Tinderbox User committed
55 56 57 58 59 60
      generates a key pair of files that referencing a key object stored
      in a cryptographic hardware service module (HSM).  The private key
      file can be used for DNSSEC signing of zone data as if it were a
      conventional signing key created by <span><strong class="command">dnssec-keygen</strong></span>,
      but the key material is stored within the HSM, and the actual signing
      takes place there.
Francis Dupont's avatar
Francis Dupont committed
61
    </p>
Automatic Updater's avatar
regen  
Automatic Updater committed
62 63 64 65 66
<p>
      The <code class="option">name</code> of the key is specified on the command
      line.  This must match the name of the zone for which the key is
      being generated.
    </p>
Francis Dupont's avatar
Francis Dupont committed
67 68
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
69
<a name="id2624802"></a><h2>OPTIONS</h2>
Francis Dupont's avatar
Francis Dupont committed
70 71 72 73
<div class="variablelist"><dl>
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
<dd>
<p>
Automatic Updater's avatar
regen  
Automatic Updater committed
74
	    Selects the cryptographic algorithm.  The value of
Automatic Updater's avatar
regen  
Automatic Updater committed
75
            <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
Tinderbox User's avatar
Tinderbox User committed
76 77
	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
	    ECDSAP256SHA256 or ECDSAP384SHA384.
Automatic Updater's avatar
regen  
Automatic Updater committed
78
	    These values are case insensitive.
Automatic Updater's avatar
regen  
Automatic Updater committed
79
	  </p>
Automatic Updater's avatar
regen  
Automatic Updater committed
80 81 82
<p>
            If no algorithm is specified, then RSASHA1 will be used by
            default, unless the <code class="option">-3</code> option is specified,
Automatic Updater's avatar
regen  
Automatic Updater committed
83 84 85
            in which case NSEC3RSASHA1 will be used instead.  (If
            <code class="option">-3</code> is used and an algorithm is specified,
            that algorithm will be checked for compatibility with NSEC3.)
Automatic Updater's avatar
regen  
Automatic Updater committed
86
          </p>
Francis Dupont's avatar
Francis Dupont committed
87 88
<p>
            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
Automatic Updater's avatar
regen  
Automatic Updater committed
89
            algorithm, and DSA is recommended.
Francis Dupont's avatar
Francis Dupont committed
90 91 92 93 94
          </p>
<p>
            Note 2: DH automatically sets the -k flag.
          </p>
</dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
95 96 97 98 99 100 101
<dt><span class="term">-3</span></dt>
<dd><p>
	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
            If this option is used and no algorithm is explicitly
            set on the command line, NSEC3RSASHA1 will be used by
            default.
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
102
<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
Tinderbox User's avatar
Tinderbox User committed
103 104 105 106 107 108 109 110 111 112 113 114 115
<dd>
<p>
            Specifies the cryptographic hardware to use.
          </p>
<p>
            When BIND is built with OpenSSL PKCS#11 support, this defaults
            to the string "pkcs11", which identifies an OpenSSL engine
            that can drive a cryptographic accelerator or hardware service
            module.  When BIND is built with native PKCS#11 cryptography
            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
            provider library specified via "--with-pkcs11".
          </p>
</dd>
Francis Dupont's avatar
Francis Dupont committed
116
<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
Tinderbox User's avatar
Tinderbox User committed
117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146
<dd>
<p>
            Specifies the label for a key pair in the crypto hardware.
          </p>
<p>
            When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
            PKCS#11 support, the label is an arbitrary string that
            identifies a particular key.  It may be preceded by an
            optional OpenSSL engine name, followed by a colon, as in
            "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
          </p>
<p>
            When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
            support, the label is a PKCS#11 URI string in the format
            "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
            Keywords include "token", which identifies the HSM; "object", which
            identifies the key; and "pin-source", which identifies a file from
            which the HSM's PIN code can be obtained.  The label will be
            stored in the on-disk "private" file.
          </p>
<p>
            If the label contains a
            <code class="option">pin-source</code> field, tools using the generated
            key files will be able to use the HSM for signing and other
            operations without any need for an operator to manually enter
            a PIN.  Note: Making the HSM's PIN accessible in this manner
            may reduce the security advantage of using an HSM; be sure
            this is what you want to do before making use of this feature.
          </p>
</dd>
Francis Dupont's avatar
Francis Dupont committed
147 148 149 150 151 152 153
<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
<dd><p>
            Specifies the owner type of the key.  The value of
            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
            a host (KEY)),
            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
Automatic Updater's avatar
regen  
Automatic Updater committed
154 155 156 157 158 159 160 161 162 163 164
            These values are case insensitive.
          </p></dd>
<dt><span class="term">-C</span></dt>
<dd><p>
	    Compatibility mode:  generates an old-style key, without
	    any metadata.  By default, <span><strong class="command">dnssec-keyfromlabel</strong></span>
	    will include the key's creation date in the metadata stored
	    with the private key, and other dates may be set there as well
	    (publication date, activation date, etc).  Keys that include
	    this data may be incompatible with older versions of BIND; the
	    <code class="option">-C</code> option suppresses them.
Francis Dupont's avatar
Francis Dupont committed
165 166 167 168 169 170 171 172 173
          </p></dd>
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
<dd><p>
            Indicates that the DNS record containing the key should have
            the specified class.  If not specified, class IN is used.
          </p></dd>
<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
<dd><p>
            Set the specified flag in the flag field of the KEY/DNSKEY record.
Automatic Updater's avatar
regen  
Automatic Updater committed
174
            The only recognized flags are KSK (Key Signing Key) and REVOKE.
Francis Dupont's avatar
Francis Dupont committed
175
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
176 177 178 179 180
<dt><span class="term">-G</span></dt>
<dd><p>
            Generate a key, but do not publish it or sign with it.  This
            option is incompatible with -P and -A.
          </p></dd>
Francis Dupont's avatar
Francis Dupont committed
181 182 183
<dt><span class="term">-h</span></dt>
<dd><p>
            Prints a short summary of the options and arguments to
Automatic Updater's avatar
regen  
Automatic Updater committed
184
            <span><strong class="command">dnssec-keyfromlabel</strong></span>.
Francis Dupont's avatar
Francis Dupont committed
185
          </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
186 187 188 189
<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
<dd><p>
            Sets the directory in which the key files are to be written.
          </p></dd>
Francis Dupont's avatar
Francis Dupont committed
190 191 192 193
<dt><span class="term">-k</span></dt>
<dd><p>
            Generate KEY records rather than DNSKEY records.
          </p></dd>
Automatic Updater's avatar
Automatic Updater committed
194 195 196 197 198 199 200 201 202
<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
<dd><p>
            Sets the default TTL to use for this key when it is converted
            into a DNSKEY RR.  If the key is imported into a zone,
            this is the TTL that will be used for it, unless there was
            already a DNSKEY RRset in place, in which case the existing TTL
            would take precedence.  Setting the default TTL to
            <code class="literal">0</code> or <code class="literal">none</code> removes it.
          </p></dd>
Francis Dupont's avatar
Francis Dupont committed
203 204
<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
<dd><p>
Automatic Updater's avatar
regen  
Automatic Updater committed
205
            Sets the protocol value for the key.  The protocol
Francis Dupont's avatar
Francis Dupont committed
206 207 208 209
            is a number between 0 and 255.  The default is 3 (DNSSEC).
            Other possible values for this argument are listed in
            RFC 2535 and its successors.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
210 211 212 213 214 215 216 217 218 219
<dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
<dd><p>
            Generate a key as an explicit successor to an existing key.
	    The name, algorithm, size, and type of the key will be set
	    to match the predecessor. The activation date of the new
	    key will be set to the inactivation date of the existing
	    one. The publication date will be set to the activation
	    date minus the prepublication interval, which defaults to
	    30 days.
          </p></dd>
Francis Dupont's avatar
Francis Dupont committed
220 221 222 223 224 225 226 227 228 229 230
<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
<dd><p>
            Indicates the use of the key.  <code class="option">type</code> must be
            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
            is AUTHCONF.  AUTH refers to the ability to authenticate
            data, and CONF the ability to encrypt data.
          </p></dd>
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
<dd><p>
            Sets the debugging level.
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
231 232 233 234
<dt><span class="term">-V</span></dt>
<dd><p>
	    Prints version information.
	  </p></dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
235 236 237 238 239 240 241 242
<dt><span class="term">-y</span></dt>
<dd><p>
            Allows DNSSEC key files to be generated even if the key ID
	    would collide with that of an existing key, in the event of
	    either key being revoked.  (This is only safe to use if you
            are sure you won't be using RFC 5011 trust anchor maintenance
            with either of the keys involved.)
          </p></dd>
Francis Dupont's avatar
Francis Dupont committed
243 244 245
</dl></div>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
246
<a name="id2675856"></a><h2>TIMING OPTIONS</h2>
Automatic Updater's avatar
regen  
Automatic Updater committed
247 248 249 250 251 252 253 254
<p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
      an offset from the present time.  For convenience, if such an offset
      is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi',
      then the offset is computed in years (defined as 365 24-hour days,
      ignoring leap years), months (defined as 30 24-hour days), weeks,
      days, hours, or minutes, respectively.  Without a suffix, the offset
Tinderbox User's avatar
Tinderbox User committed
255 256
      is computed in seconds.  To explicitly prevent a date from being
      set, use 'none' or 'never'.
Automatic Updater's avatar
regen  
Automatic Updater committed
257 258 259 260 261 262
    </p>
<div class="variablelist"><dl>
<dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
<dd><p>
            Sets the date on which a key is to be published to the zone.
            After that date, the key will be included in the zone but will
Automatic Updater's avatar
regen  
Automatic Updater committed
263 264
            not be used to sign it.  If not set, and if the -G option has
            not been used, the default is "now".
Automatic Updater's avatar
regen  
Automatic Updater committed
265 266 267 268
          </p></dd>
<dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
<dd><p>
            Sets the date on which the key is to be activated.  After that
Automatic Updater's avatar
regen  
Automatic Updater committed
269
            date, the key will be included in the zone and used to sign
Automatic Updater's avatar
regen  
Automatic Updater committed
270 271
            it.  If not set, and if the -G option has not been used, the
            default is "now".
Automatic Updater's avatar
regen  
Automatic Updater committed
272 273 274 275 276 277 278
          </p></dd>
<dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
<dd><p>
            Sets the date on which the key is to be revoked.  After that
            date, the key will be flagged as revoked.  It will be included
            in the zone and will be used to sign it.
          </p></dd>
Automatic Updater's avatar
Automatic Updater committed
279
<dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
Automatic Updater's avatar
regen  
Automatic Updater committed
280
<dd><p>
Automatic Updater's avatar
regen  
Automatic Updater committed
281 282 283
            Sets the date on which the key is to be retired.  After that
            date, the key will still be included in the zone, but it
            will not be used to sign it.
Automatic Updater's avatar
regen  
Automatic Updater committed
284 285 286 287
          </p></dd>
<dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
<dd><p>
            Sets the date on which the key is to be deleted.  After that
Automatic Updater's avatar
regen  
Automatic Updater committed
288 289
            date, the key will no longer be included in the zone.  (It
            may remain in the key repository, however.)
Automatic Updater's avatar
regen  
Automatic Updater committed
290
          </p></dd>
Tinderbox User's avatar
Tinderbox User committed
291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314
<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
<dd>
<p>
            Sets the prepublication interval for a key.  If set, then
            the publication and activation dates must be separated by at least
            this much time.  If the activation date is specified but the
            publication date isn't, then the publication date will default
            to this much time before the activation date; conversely, if
            the publication date is specified but activation date isn't,
            then activation will be set to this much time after publication.
          </p>
<p>
            If the key is being created as an explicit successor to another
            key, then the default prepublication interval is 30 days; 
            otherwise it is zero.
          </p>
<p>
            As with date offsets, if the argument is followed by one of
            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
            interval is measured in years, months, weeks, days, hours,
            or minutes, respectively.  Without a suffix, the interval is
            measured in seconds.
          </p>
</dd>
Automatic Updater's avatar
regen  
Automatic Updater committed
315 316 317
</dl></div>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
318
<a name="id2676182"></a><h2>GENERATED KEY FILES</h2>
Francis Dupont's avatar
Francis Dupont committed
319 320 321 322 323 324 325 326 327 328 329
<p>
      When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
      successfully,
      it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
      to the standard output.  This is an identification string for
      the key files it has generated.
    </p>
<div class="itemizedlist"><ul type="disc">
<li><p><code class="filename">nnnn</code> is the key name.
        </p></li>
<li><p><code class="filename">aaa</code> is the numeric representation
Automatic Updater's avatar
regen  
Automatic Updater committed
330
          of the algorithm.
Francis Dupont's avatar
Francis Dupont committed
331 332 333 334 335 336 337 338 339 340
        </p></li>
<li><p><code class="filename">iiiii</code> is the key identifier (or
          footprint).
        </p></li>
</ul></div>
<p><span><strong class="command">dnssec-keyfromlabel</strong></span> 
      creates two files, with names based
      on the printed string.  <code class="filename">Knnnn.+aaa+iiiii.key</code>
      contains the public key, and
      <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
Automatic Updater's avatar
regen  
Automatic Updater committed
341
      private key.
Francis Dupont's avatar
Francis Dupont committed
342 343 344 345 346 347 348 349
    </p>
<p>
      The <code class="filename">.key</code> file contains a DNS KEY record
      that
      can be inserted into a zone file (directly or with a $INCLUDE
      statement).
    </p>
<p>
Automatic Updater's avatar
regen  
Automatic Updater committed
350 351
      The <code class="filename">.private</code> file contains
      algorithm-specific
Francis Dupont's avatar
Francis Dupont committed
352 353 354 355 356
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </p>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
357
<a name="id2676344"></a><h2>SEE ALSO</h2>
Francis Dupont's avatar
Francis Dupont committed
358 359 360
<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
Tinderbox User's avatar
Tinderbox User committed
361 362
      <em class="citetitle">RFC 4034</em>,
      <em class="citetitle">The PKCS#11 URI Scheme (draft-pechanec-pkcs11uri-13)</em>.
Francis Dupont's avatar
Francis Dupont committed
363 364 365
    </p>
</div>
<div class="refsect1" lang="en">
Tinderbox User's avatar
Tinderbox User committed
366
<a name="id2676381"></a><h2>AUTHOR</h2>
Francis Dupont's avatar
Francis Dupont committed
367 368 369 370 371 372 373 374 375
<p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
</div>
</div>
<div class="navfooter">
<hr>
<table width="100%" summary="Navigation footer">
<tr>
<td width="40%" align="left">
Tinderbox User's avatar
Tinderbox User committed
376
<a accesskey="p" href="man.dnssec-importkey.html">Prev</a> </td>
Tinderbox User's avatar
Tinderbox User committed
377
<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch13.html">Up</a></td>
Francis Dupont's avatar
Francis Dupont committed
378 379 380 381
<td width="40%" align="right"> <a accesskey="n" href="man.dnssec-keygen.html">Next</a>
</td>
</tr>
<tr>
Automatic Updater's avatar
regen  
Automatic Updater committed
382
<td width="40%" align="left" valign="top">
Tinderbox User's avatar
Tinderbox User committed
383
<span class="application">dnssec-importkey</span> </td>
Francis Dupont's avatar
Francis Dupont committed
384 385 386 387 388 389
<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
<td width="40%" align="right" valign="top"> <span class="application">dnssec-keygen</span>
</td>
</tr>
</table>
</div>
Tinderbox User's avatar
Tinderbox User committed
390
<p style="text-align: center;">BIND 9.11.0pre-alpha</p>
Francis Dupont's avatar
Francis Dupont committed
391 392
</body>
</html>