dnssec-makekeyset [-h] [-s start-time] [-e end-time] [-t TTL] [-r
randomdev] [-p] [-v level] keyfile ....
DESCRIPTION
dnssec-makekeyset generates a key set from one or more keys created by
dnssec-keygen(8). It creates a file containing KEY and SIG records for
some zone which can then be signed by the zone's parent if the parent
zone is DNSSEC-aware. keyfile should be a key identification string as
reported by dnssec-keygen(8): i.e. Knnnn.+aaa+iiiii where nnnn is the
name of the key, aaa is the encryption algorithm and iiiii is the key
identifier. Multiple keyfile arguments can be supplied when there are
several keys to be combined by dnssec-makekeyset into a key set.
For any SIG records that are in the key set, the start time when the SIG
records become valid is specified with the -s option. start-time can ei
ther be an absolute or relative date. An absolute start time is indicat
ed by a number in YYYYMMDDHHMMSS notation: 20000530144500 denotes
14:45:00 UTC on May 30th, 2000. A relative start time is supplied when
start-time is given as +N: N seconds from the current time. If no -s op
tion is supplied, the current date and time is used for the start time of
the SIG records.
The expiry date for the SIG records can be set by the -e option. Note
that in this context, the expiry date specifies when the SIG records are
no longer valid, not when they are deleted from caches on name servers.
end-date also represents an absolute or relative date. YYYYMMDDHHMMSS
notation is used as before to indicate an absolute date and time. When
end-date is +N, it indicates that the SIG records will expire in N sec
onds after their start date. If end-date is written as now+N, the SIG
records will expire in N seconds after the current time. When no expiry
date is set for the SIG records, dnssec-makekeyset defaults to an expire
time of 30 days from the start time of the SIG records.
An alternate source of random data can be specified with the -r option.
randomdev is the name of the file to use to obtain random data. By de
fault /dev/random is used if this device is available. If it is not pro
vided by the operating system and no -r option is used, dnssec-makekeyset
will prompt the user for input from the keyboard and use the time between
keystrokes to derive some random data.
The -p option instructs dnssec-makekeyset to use pseudo-random data when
self-signing the keyset. This is faster, but less secure, than using
genuinely random data for signing. This option may be useful when the
entropy source is limited.
The -t option is followed by a time-to-live argument TTL which indicates
the TTL value that will be assigned to the assembled KEY and SIG records
in the output file. TTL is expressed in seconds. If no -t option is
provided, dnssec-makekeyset prints a warning and uses a default TTL of
3600 seconds.
The -v option can be used to make dnssec-makekeyset more verbose. As the
debugging/tracing level level increases, dnssec-makekeyset generates in
creasingly detailed reports about what it is doing. The default level is
zero.
EXAMPLE
The following command generates a key set for the DSA key for example.com
that was shown in the dnssec-keygen(8) man page. The backslash is for
typographic reasons and would not be provided on the command line when
running dnssec-makekeyset.
# dnssec-makekeyset -t 86400 -s 20000701120000 \
-e +2592000 Kexample.com.+003+26160
dnssec-makekeyset will create a file called keyset-example.com. contain
ing a SIG and KEY record for example.com. These records will have a TTL
of 86400 seconds (1 day). The SIG record becomes valid at noon UTC on
July 1st 2000 and expires 30 days (2592000 seconds) later.
The DNS administrator for example.com could then send keyset-example.com.
to the DNS administrator for .com so that they could sign the resource
records in the file. This assumes that the .com zone is DNSSEC-aware and
the administrators of the two zones have some mechanism for authenticat
ing each other and exchanging the keys and signatures securely.
FILES
/dev/random.
SEE ALSO
RFC2535, dnssec-keygen(8), dnssec-signkey(8).
BIND9 Jun 30, 2000 2
Man(1) output converted with
man2html