1.. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2.. 3.. SPDX-License-Identifier: MPL-2.0 4.. 5.. This Source Code Form is subject to the terms of the Mozilla Public 6.. License, v. 2.0. If a copy of the MPL was not distributed with this 7.. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8.. 9.. See the COPYRIGHT file distributed with this work for additional 10.. information regarding copyright ownership. 11 12.. highlight: console 13 14.. iscman:: dnssec-importkey 15.. program:: dnssec-importkey 16.. _man_dnssec-importkey: 17 18dnssec-importkey - import DNSKEY records from external systems so they can be managed 19------------------------------------------------------------------------------------- 20 21Synopsis 22~~~~~~~~ 23 24:program:`dnssec-importkey` [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] {keyfile} 25 26:program:`dnssec-importkey` {**-f** filename} [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] [dnsname] 27 28Description 29~~~~~~~~~~~ 30 31:program:`dnssec-importkey` reads a public DNSKEY record and generates a pair 32of .key/.private files. The DNSKEY record may be read from an 33existing .key file, in which case a corresponding .private file is 34generated, or it may be read from any other file or from the standard 35input, in which case both .key and .private files are generated. 36 37The newly created .private file does *not* contain private key data, and 38cannot be used for signing. However, having a .private file makes it 39possible to set publication (:option:`-P`) and deletion (:option:`-D`) times for the 40key, which means the public key can be added to and removed from the 41DNSKEY RRset on schedule even if the true private key is stored offline. 42 43Options 44~~~~~~~ 45 46.. option:: -f filename 47 48 This option indicates the zone file mode. Instead of a public keyfile name, the argument is the 49 DNS domain name of a zone master file, which can be read from 50 ``filename``. If the domain name is the same as ``filename``, then it may be 51 omitted. 52 53 If ``filename`` is set to ``"-"``, then the zone data is read from the 54 standard input. 55 56.. option:: -K directory 57 58 This option sets the directory in which the key files are to reside. 59 60.. option:: -L ttl 61 62 This option sets the default TTL to use for this key when it is converted into a 63 DNSKEY RR. This is the TTL used when the key is imported into a zone, 64 unless there was already a DNSKEY RRset in 65 place, in which case the existing TTL takes precedence. Setting the default TTL to ``0`` or ``none`` 66 removes it from the key. 67 68.. option:: -h 69 70 This option emits a usage message and exits. 71 72.. option:: -v level 73 74 This option sets the debugging level. 75 76.. option:: -V 77 78 This option prints version information. 79 80Timing Options 81~~~~~~~~~~~~~~ 82 83Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. 84(which is the format used inside key files), 85or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``), 86or UNIX epoch time (as printed by ``dnssec-settime -up``), 87or the literal ``now``. 88 89The argument can be followed by ``+`` or ``-`` and an offset from the 90given time. The literal ``now`` can be omitted before an offset. The 91offset can be followed by one of the suffixes ``y``, ``mo``, ``w``, 92``d``, ``h``, or ``mi``, so that it is computed in years (defined as 93365 24-hour days, ignoring leap years), months (defined as 30 24-hour 94days), weeks, days, hours, or minutes, respectively. Without a suffix, 95the offset is computed in seconds. 96 97To explicitly prevent a date from being set, use ``none``, ``never``, 98or ``unset``. 99 100All these formats are case-insensitive. 101 102.. option:: -P date/offset 103 104 This option sets the date on which a key is to be published to the zone. After 105 that date, the key is included in the zone but is not used 106 to sign it. 107 108 .. program:: dnssec-importkey -P 109 .. option:: sync date/offset 110 111 This option sets the date on which CDS and CDNSKEY records that match this key 112 are to be published to the zone. 113 114.. program:: dnssec-importkey 115 116.. option:: -D date/offset 117 118 This option sets the date on which the key is to be deleted. After that date, the 119 key is no longer included in the zone. (However, it may remain in the key 120 repository.) 121 122 .. program:: dnssec-importkey -D 123 .. option:: sync date/offset 124 125 This option sets the date on which the CDS and CDNSKEY records that match this 126 key are to be deleted. 127 128.. program:: dnssec-importkey 129 130 131Files 132~~~~~ 133 134A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii`` 135or the full file name ``Knnnn.+aaa+iiiii.key``, as generated by 136:iscman:`dnssec-keygen`. 137 138See Also 139~~~~~~~~ 140 141:iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual, 142:rfc:`5011`. 143