diff options
Diffstat (limited to 'doc/man/dnssec-importkey.8in')
| -rw-r--r-- | doc/man/dnssec-importkey.8in | 126 |
1 files changed, 126 insertions, 0 deletions
diff --git a/doc/man/dnssec-importkey.8in b/doc/man/dnssec-importkey.8in new file mode 100644 index 0000000..8a50888 --- /dev/null +++ b/doc/man/dnssec-importkey.8in @@ -0,0 +1,126 @@ +.\" Man page generated from reStructuredText. +. +. +.nr rst2man-indent-level 0 +. +.de1 rstReportMargin +\\$1 \\n[an-margin] +level \\n[rst2man-indent-level] +level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] +- +\\n[rst2man-indent0] +\\n[rst2man-indent1] +\\n[rst2man-indent2] +.. +.de1 INDENT +.\" .rstReportMargin pre: +. RS \\$1 +. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] +. nr rst2man-indent-level +1 +.\" .rstReportMargin post: +.. +.de UNINDENT +. RE +.\" indent \\n[an-margin] +.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] +.nr rst2man-indent-level -1 +.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] +.in \\n[rst2man-indent\\n[rst2man-indent-level]]u +.. +.TH "DNSSEC-IMPORTKEY" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9" +.SH NAME +dnssec-importkey \- import DNSKEY records from external systems so they can be managed +.SH SYNOPSIS +.sp +\fBdnssec\-importkey\fP [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-h\fP] [\fB\-v\fP level] [\fB\-V\fP] {keyfile} +.sp +\fBdnssec\-importkey\fP {\fB\-f\fP filename} [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP sync date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP sync date/offset] [\fB\-h\fP] [\fB\-v\fP level] [\fB\-V\fP] [dnsname] +.SH DESCRIPTION +.sp +\fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair +of .key/.private files. The DNSKEY record may be read from an +existing .key file, in which case a corresponding .private file is +generated, or it may be read from any other file or from the standard +input, in which case both .key and .private files are generated. +.sp +The newly created .private file does \fInot\fP contain private key data, and +cannot be used for signing. However, having a .private file makes it +possible to set publication (\fB\-P\fP) and deletion (\fB\-D\fP) times for the +key, which means the public key can be added to and removed from the +DNSKEY RRset on schedule even if the true private key is stored offline. +.SH OPTIONS +.INDENT 0.0 +.TP +.B \fB\-f filename\fP +This option indicates the zone file mode. Instead of a public keyfile name, the argument is the +DNS domain name of a zone master file, which can be read from +\fBfilename\fP\&. If the domain name is the same as \fBfilename\fP, then it may be +omitted. +.sp +If \fBfilename\fP is set to \fB\(dq\-\(dq\fP, then the zone data is read from the +standard input. +.TP +.B \fB\-K directory\fP +This option sets the directory in which the key files are to reside. +.TP +.B \fB\-L ttl\fP +This option sets the default TTL to use for this key when it is converted into a +DNSKEY RR. This is the TTL used when the key is imported into a zone, +unless there was already a DNSKEY RRset in +place, in which case the existing TTL takes precedence. Setting the default TTL to \fB0\fP or \fBnone\fP +removes it from the key. +.TP +.B \fB\-h\fP +This option emits a usage message and exits. +.TP +.B \fB\-v level\fP +This option sets the debugging level. +.TP +.B \fB\-V\fP +This option prints version information. +.UNINDENT +.SH TIMING OPTIONS +.sp +Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the +argument begins with a \fB+\fP or \fB\-\fP, it is interpreted as an offset from +the present time. For convenience, if such an offset is followed by one +of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, then the offset is +computed in years (defined as 365 24\-hour days, ignoring leap years), +months (defined as 30 24\-hour days), weeks, days, hours, or minutes, +respectively. Without a suffix, the offset is computed in seconds. To +explicitly prevent a date from being set, use \fBnone\fP or \fBnever\fP\&. +.INDENT 0.0 +.TP +.B \fB\-P date/offset\fP +This option sets the date on which a key is to be published to the zone. After +that date, the key is included in the zone but is not used +to sign it. +.TP +.B \fB\-P sync date/offset\fP +This option sets the date on which CDS and CDNSKEY records that match this key +are to be published to the zone. +.TP +.B \fB\-D date/offset\fP +This option sets the date on which the key is to be deleted. After that date, the +key is no longer included in the zone. (However, it may remain in the key +repository.) +.TP +.B \fB\-D sync date/offset\fP +This option sets the date on which the CDS and CDNSKEY records that match this +key are to be deleted. +.UNINDENT +.SH FILES +.sp +A keyfile can be designed by the key identification \fBKnnnn.+aaa+iiiii\fP +or the full file name \fBKnnnn.+aaa+iiiii.key\fP, as generated by +\fBdnssec\-keygen\fP\&. +.SH SEE ALSO +.sp +\fBdnssec\-keygen(8)\fP, \fBdnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual, +\fI\%RFC 5011\fP\&. +.SH AUTHOR +Internet Systems Consortium +.SH COPYRIGHT +2023, Internet Systems Consortium +.\" Generated by docutils manpage writer. +. |