1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
.\" Man page generated from reStructuredText.
.
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "KZONESIGN" "1" "@RELEASE_DATE@" "@VERSION@" "Knot DNS"
.SH NAME
kzonesign \- DNSSEC signing utility
.SH SYNOPSIS
.sp
\fBkzonesign\fP [\fIconfig_option\fP \fIconfig_argument\fP] [\fIoptions\fP] \fIzone_name\fP
.SH DESCRIPTION
.sp
This utility reads the zone\(aqs zone file, signs the zone according to given
configuration, and writes the signed zone file back. An alternative mode
is DNSSEC validation of the given zone. The signing or validation
can run in parallel if enabled in the configuration (see policy.signing\-threads
and zone.adjust\-threads).
.SS Config options
.INDENT 0.0
.TP
\fB\-c\fP, \fB\-\-config\fP \fIfile\fP
Use a textual configuration file (default is \fB@config_dir@/knot.conf\fP).
.TP
\fB\-C\fP, \fB\-\-confdb\fP \fIdirectory\fP
Use a binary configuration database directory (default is \fB@storage_dir@/confdb\fP).
The default configuration database, if exists, has a preference to the default
configuration file.
.UNINDENT
.SS Options
.INDENT 0.0
.TP
\fB\-o\fP, \fB\-\-outdir\fP \fIdir_name\fP
Write the output zone file to the specified directory instead of the configured one.
.TP
\fB\-r\fP, \fB\-\-rollover\fP
Allow key roll\-overs and NSEC3 re\-salt. In order to finish possible KSK submission,
set the KSK\(aqs \fBactive\fP timestamp to now (\fB+0\fP) using keymgr\&.
.TP
\fB\-v\fP, \fB\-\-verify\fP
Instead of (re\-)signing the zone, just verify that the zone is correctly signed.
.TP
\fB\-t\fP, \fB\-\-time\fP \fItimestamp\fP
Sign/verify the zone (and roll the keys if necessary) as if it was at the time
specified by timestamp.
.TP
\fB\-h\fP, \fB\-\-help\fP
Print the program help.
.TP
\fB\-V\fP, \fB\-\-version\fP
Print the program version.
.UNINDENT
.SS Parameters
.INDENT 0.0
.TP
\fIzone_name\fP
A name of the zone to be signed.
.UNINDENT
.SH EXIT VALUES
.sp
Exit status of 0 means successful operation. Any other exit status indicates
an error.
.SH SEE ALSO
.sp
\fBknot.conf(5)\fP, \fBkeymgr(8)\fP\&.
.SH AUTHOR
CZ.NIC Labs <https://www.knot-dns.cz>
.SH COPYRIGHT
Copyright 2010–2023, CZ.NIC, z.s.p.o.
.\" Generated by docutils manpage writer.
.
|
