1.. 2 Copyright (C) Internet Systems Consortium, Inc. ("ISC") 3 4 This Source Code Form is subject to the terms of the Mozilla Public 5 License, v. 2.0. If a copy of the MPL was not distributed with this 6 file, You can obtain one at http://mozilla.org/MPL/2.0/. 7 8 See the COPYRIGHT file distributed with this work for additional 9 information regarding copyright ownership. 10 11.. 12 Copyright (C) Internet Systems Consortium, Inc. ("ISC") 13 14 This Source Code Form is subject to the terms of the Mozilla Public 15 License, v. 2.0. If a copy of the MPL was not distributed with this 16 file, You can obtain one at http://mozilla.org/MPL/2.0/. 17 18 See the COPYRIGHT file distributed with this work for additional 19 information regarding copyright ownership. 20 21 22.. highlight: console 23 24.. _man_dnssec-importkey: 25 26dnssec-importkey - import DNSKEY records from external systems so they can be managed 27------------------------------------------------------------------------------------- 28 29Synopsis 30~~~~~~~~ 31 32:program:`dnssec-importkey` [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] {keyfile} 33 34:program:`dnssec-importkey` {**-f** filename} [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] [dnsname] 35 36Description 37~~~~~~~~~~~ 38 39``dnssec-importkey`` reads a public DNSKEY record and generates a pair 40of .key/.private files. The DNSKEY record may be read from an existing 41.key file, in which case a corresponding .private file will be 42generated, or it may be read from any other file or from the standard 43input, in which case both .key and .private files will be generated. 44 45The newly-created .private file does *not* contain private key data, and 46cannot be used for signing. However, having a .private file makes it 47possible to set publication (``-P``) and deletion (``-D``) times for the 48key, which means the public key can be added to and removed from the 49DNSKEY RRset on schedule even if the true private key is stored offline. 50 51Options 52~~~~~~~ 53 54**-f** filename 55 Zone file mode: instead of a public keyfile name, the argument is the 56 DNS domain name of a zone master file, which can be read from 57 ``file``. If the domain name is the same as ``file``, then it may be 58 omitted. 59 60 If ``file`` is set to ``"-"``, then the zone data is read from the 61 standard input. 62 63**-K** directory 64 Sets the directory in which the key files are to reside. 65 66**-L** ttl 67 Sets the default TTL to use for this key when it is converted into a 68 DNSKEY RR. If the key is imported into a zone, this is the TTL that 69 will be used for it, unless there was already a DNSKEY RRset in 70 place, in which case the existing TTL would take precedence. Setting 71 the default TTL to ``0`` or ``none`` removes it. 72 73**-h** 74 Emit usage message and exit. 75 76**-v** level 77 Sets the debugging level. 78 79**-V** 80 Prints version information. 81 82Timing Options 83~~~~~~~~~~~~~~ 84 85Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the 86argument begins with a '+' or '-', it is interpreted as an offset from 87the present time. For convenience, if such an offset is followed by one 88of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is 89computed in years (defined as 365 24-hour days, ignoring leap years), 90months (defined as 30 24-hour days), weeks, days, hours, or minutes, 91respectively. Without a suffix, the offset is computed in seconds. To 92explicitly prevent a date from being set, use 'none' or 'never'. 93 94**-P** date/offset 95 Sets the date on which a key is to be published to the zone. After 96 that date, the key will be included in the zone but will not be used 97 to sign it. 98 99**-P** sync date/offset 100 Sets the date on which CDS and CDNSKEY records that match this key 101 are to be published to the zone. 102 103**-D** date/offset 104 Sets the date on which the key is to be deleted. After that date, the 105 key will no longer be included in the zone. (It may remain in the key 106 repository, however.) 107 108**-D** sync date/offset 109 Sets the date on which the CDS and CDNSKEY records that match this 110 key are to be deleted. 111 112Files 113~~~~~ 114 115A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii`` 116or the full file name ``Knnnn.+aaa+iiiii.key`` as generated by 117dnssec-keygen8. 118 119See Also 120~~~~~~~~ 121 122:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual, 123:rfc:`5011`. 124