1<!-- 2 - Copyright (C) 2004-2012 Internet Systems Consortium, Inc. ("ISC") 3 - Copyright (C) 2000-2003 Internet Software Consortium. 4 - 5 - Permission to use, copy, modify, and/or distribute this software for any 6 - purpose with or without fee is hereby granted, provided that the above 7 - copyright notice and this permission notice appear in all copies. 8 - 9 - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 10 - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 11 - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 12 - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 13 - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 14 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 15 - PERFORMANCE OF THIS SOFTWARE. 16--> 17<!-- $Id$ --> 18<html> 19<head> 20<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> 21<title>dnssec-signzone</title> 22<meta name="generator" content="DocBook XSL Stylesheets V1.71.1"> 23<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual"> 24<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages"> 25<link rel="prev" href="man.dnssec-settime.html" title="dnssec-settime"> 26<link rel="next" href="man.named-checkconf.html" title="named-checkconf"> 27</head> 28<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"> 29<div class="navheader"> 30<table width="100%" summary="Navigation header"> 31<tr><th colspan="3" align="center"><span class="application">dnssec-signzone</span></th></tr> 32<tr> 33<td width="20%" align="left"> 34<a accesskey="p" href="man.dnssec-settime.html">Prev</a>�</td> 35<th width="60%" align="center">Manual pages</th> 36<td width="20%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a> 37</td> 38</tr> 39</table> 40<hr> 41</div> 42<div class="refentry" lang="en"> 43<a name="man.dnssec-signzone"></a><div class="titlepage"></div> 44<div class="refnamediv"> 45<h2>Name</h2> 46<p><span class="application">dnssec-signzone</span> — DNSSEC zone signing tool</p> 47</div> 48<div class="refsynopsisdiv"> 49<h2>Synopsis</h2> 50<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-P</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div> 51</div> 52<div class="refsect1" lang="en"> 53<a name="id2617803"></a><h2>DESCRIPTION</h2> 54<p><span><strong class="command">dnssec-signzone</strong></span> 55 signs a zone. It generates 56 NSEC and RRSIG records and produces a signed version of the 57 zone. The security status of delegations from the signed zone 58 (that is, whether the child zones are secure or not) is 59 determined by the presence or absence of a 60 <code class="filename">keyset</code> file for each child zone. 61 </p> 62</div> 63<div class="refsect1" lang="en"> 64<a name="id2617822"></a><h2>OPTIONS</h2> 65<div class="variablelist"><dl> 66<dt><span class="term">-a</span></dt> 67<dd><p> 68 Verify all generated signatures. 69 </p></dd> 70<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt> 71<dd><p> 72 Specifies the DNS class of the zone. 73 </p></dd> 74<dt><span class="term">-C</span></dt> 75<dd><p> 76 Compatibility mode: Generate a 77 <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code> 78 file in addition to 79 <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code> 80 when signing a zone, for use by older versions of 81 <span><strong class="command">dnssec-signzone</strong></span>. 82 </p></dd> 83<dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt> 84<dd><p> 85 Look for <code class="filename">dsset-</code> or 86 <code class="filename">keyset-</code> files in <code class="option">directory</code>. 87 </p></dd> 88<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt> 89<dd><p> 90 Uses a crypto hardware (OpenSSL engine) for the crypto operations 91 it supports, for instance signing with private keys from 92 a secure key store. When compiled with PKCS#11 support 93 it defaults to pkcs11; the empty name resets it to no engine. 94 </p></dd> 95<dt><span class="term">-g</span></dt> 96<dd><p> 97 Generate DS records for child zones from 98 <code class="filename">dsset-</code> or <code class="filename">keyset-</code> 99 file. Existing DS records will be removed. 100 </p></dd> 101<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt> 102<dd><p> 103 Key repository: Specify a directory to search for DNSSEC keys. 104 If not specified, defaults to the current directory. 105 </p></dd> 106<dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt> 107<dd><p> 108 Treat specified key as a key signing key ignoring any 109 key flags. This option may be specified multiple times. 110 </p></dd> 111<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt> 112<dd><p> 113 Generate a DLV set in addition to the key (DNSKEY) and DS sets. 114 The domain is appended to the name of the records. 115 </p></dd> 116<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt> 117<dd><p> 118 Specify the date and time when the generated RRSIG records 119 become valid. This can be either an absolute or relative 120 time. An absolute start time is indicated by a number 121 in YYYYMMDDHHMMSS notation; 20000530144500 denotes 122 14:45:00 UTC on May 30th, 2000. A relative start time is 123 indicated by +N, which is N seconds from the current time. 124 If no <code class="option">start-time</code> is specified, the current 125 time minus 1 hour (to allow for clock skew) is used. 126 </p></dd> 127<dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt> 128<dd><p> 129 Specify the date and time when the generated RRSIG records 130 expire. As with <code class="option">start-time</code>, an absolute 131 time is indicated in YYYYMMDDHHMMSS notation. A time relative 132 to the start time is indicated with +N, which is N seconds from 133 the start time. A time relative to the current time is 134 indicated with now+N. If no <code class="option">end-time</code> is 135 specified, 30 days from the start time is used as a default. 136 <code class="option">end-time</code> must be later than 137 <code class="option">start-time</code>. 138 </p></dd> 139<dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt> 140<dd><p> 141 The name of the output file containing the signed zone. The 142 default is to append <code class="filename">.signed</code> to 143 the 144 input filename. 145 </p></dd> 146<dt><span class="term">-h</span></dt> 147<dd><p> 148 Prints a short summary of the options and arguments to 149 <span><strong class="command">dnssec-signzone</strong></span>. 150 </p></dd> 151<dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt> 152<dd> 153<p> 154 When a previously-signed zone is passed as input, records 155 may be resigned. The <code class="option">interval</code> option 156 specifies the cycle interval as an offset from the current 157 time (in seconds). If a RRSIG record expires after the 158 cycle interval, it is retained. Otherwise, it is considered 159 to be expiring soon, and it will be replaced. 160 </p> 161<p> 162 The default cycle interval is one quarter of the difference 163 between the signature end and start times. So if neither 164 <code class="option">end-time</code> or <code class="option">start-time</code> 165 are specified, <span><strong class="command">dnssec-signzone</strong></span> 166 generates 167 signatures that are valid for 30 days, with a cycle 168 interval of 7.5 days. Therefore, if any existing RRSIG records 169 are due to expire in less than 7.5 days, they would be 170 replaced. 171 </p> 172</dd> 173<dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt> 174<dd><p> 175 The format of the input zone file. 176 Possible formats are <span><strong class="command">"text"</strong></span> (default) 177 and <span><strong class="command">"raw"</strong></span>. 178 This option is primarily intended to be used for dynamic 179 signed zones so that the dumped zone file in a non-text 180 format containing updates can be signed directly. 181 The use of this option does not make much sense for 182 non-dynamic zones. 183 </p></dd> 184<dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt> 185<dd> 186<p> 187 When signing a zone with a fixed signature lifetime, all 188 RRSIG records issued at the time of signing expires 189 simultaneously. If the zone is incrementally signed, i.e. 190 a previously-signed zone is passed as input to the signer, 191 all expired signatures have to be regenerated at about the 192 same time. The <code class="option">jitter</code> option specifies a 193 jitter window that will be used to randomize the signature 194 expire time, thus spreading incremental signature 195 regeneration over time. 196 </p> 197<p> 198 Signature lifetime jitter also to some extent benefits 199 validators and servers by spreading out cache expiration, 200 i.e. if large numbers of RRSIGs don't expire at the same time 201 from all caches there will be less congestion than if all 202 validators need to refetch at mostly the same time. 203 </p> 204</dd> 205<dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt> 206<dd><p> 207 Specifies the number of threads to use. By default, one 208 thread is started for each detected CPU. 209 </p></dd> 210<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt> 211<dd> 212<p> 213 The SOA serial number format of the signed zone. 214 Possible formats are <span><strong class="command">"keep"</strong></span> (default), 215 <span><strong class="command">"increment"</strong></span> and 216 <span><strong class="command">"unixtime"</strong></span>. 217 </p> 218<div class="variablelist"><dl> 219<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt> 220<dd><p>Do not modify the SOA serial number.</p></dd> 221<dt><span class="term"><span><strong class="command">"increment"</strong></span></span></dt> 222<dd><p>Increment the SOA serial number using RFC 1982 223 arithmetics.</p></dd> 224<dt><span class="term"><span><strong class="command">"unixtime"</strong></span></span></dt> 225<dd><p>Set the SOA serial number to the number of seconds 226 since epoch.</p></dd> 227</dl></div> 228</dd> 229<dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt> 230<dd><p> 231 The zone origin. If not specified, the name of the zone file 232 is assumed to be the origin. 233 </p></dd> 234<dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt> 235<dd><p> 236 The format of the output file containing the signed zone. 237 Possible formats are <span><strong class="command">"text"</strong></span> (default) 238 and <span><strong class="command">"raw"</strong></span>. 239 </p></dd> 240<dt><span class="term">-p</span></dt> 241<dd><p> 242 Use pseudo-random data when signing the zone. This is faster, 243 but less secure, than using real random data. This option 244 may be useful when signing large zones or when the entropy 245 source is limited. 246 </p></dd> 247<dt><span class="term">-P</span></dt> 248<dd> 249<p> 250 Disable post sign verification tests. 251 </p> 252<p> 253 The post sign verification test ensures that for each algorithm 254 in use there is at least one non revoked self signed KSK key, 255 that all revoked KSK keys are self signed, and that all records 256 in the zone are signed by the algorithm. 257 This option skips these tests. 258 </p> 259</dd> 260<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt> 261<dd><p> 262 Specifies the source of randomness. If the operating 263 system does not provide a <code class="filename">/dev/random</code> 264 or equivalent device, the default source of randomness 265 is keyboard input. <code class="filename">randomdev</code> 266 specifies 267 the name of a character device or file containing random 268 data to be used instead of the default. The special value 269 <code class="filename">keyboard</code> indicates that keyboard 270 input should be used. 271 </p></dd> 272<dt><span class="term">-S</span></dt> 273<dd> 274<p> 275 Smart signing: Instructs <span><strong class="command">dnssec-signzone</strong></span> to 276 search the key repository for keys that match the zone being 277 signed, and to include them in the zone if appropriate. 278 </p> 279<p> 280 When a key is found, its timing metadata is examined to 281 determine how it should be used, according to the following 282 rules. Each successive rule takes priority over the prior 283 ones: 284 </p> 285<div class="variablelist"><dl> 286<dt></dt> 287<dd><p> 288 If no timing metadata has been set for the key, the key is 289 published in the zone and used to sign the zone. 290 </p></dd> 291<dt></dt> 292<dd><p> 293 If the key's publication date is set and is in the past, the 294 key is published in the zone. 295 </p></dd> 296<dt></dt> 297<dd><p> 298 If the key's activation date is set and in the past, the 299 key is published (regardless of publication date) and 300 used to sign the zone. 301 </p></dd> 302<dt></dt> 303<dd><p> 304 If the key's revocation date is set and in the past, and the 305 key is published, then the key is revoked, and the revoked key 306 is used to sign the zone. 307 </p></dd> 308<dt></dt> 309<dd><p> 310 If either of the key's unpublication or deletion dates are set 311 and in the past, the key is NOT published or used to sign the 312 zone, regardless of any other metadata. 313 </p></dd> 314</dl></div> 315</dd> 316<dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt> 317<dd><p> 318 Specifies the TTL to be used for new DNSKEY records imported 319 into the zone from the key repository. If not specified, 320 the default is the minimum TTL value from the zone's SOA 321 record. This option is ignored when signing without 322 <code class="option">-S</code>, since DNSKEY records are not imported 323 from the key repository in that case. It is also ignored if 324 there are any pre-existing DNSKEY records at the zone apex, 325 in which case new records' TTL values will be set to match 326 them. 327 </p></dd> 328<dt><span class="term">-t</span></dt> 329<dd><p> 330 Print statistics at completion. 331 </p></dd> 332<dt><span class="term">-u</span></dt> 333<dd><p> 334 Update NSEC/NSEC3 chain when re-signing a previously signed 335 zone. With this option, a zone signed with NSEC can be 336 switched to NSEC3, or a zone signed with NSEC3 can 337 be switch to NSEC or to NSEC3 with different parameters. 338 Without this option, <span><strong class="command">dnssec-signzone</strong></span> will 339 retain the existing chain when re-signing. 340 </p></dd> 341<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt> 342<dd><p> 343 Sets the debugging level. 344 </p></dd> 345<dt><span class="term">-x</span></dt> 346<dd><p> 347 Only sign the DNSKEY RRset with key-signing keys, and omit 348 signatures from zone-signing keys. (This is similar to the 349 <span><strong class="command">dnssec-dnskey-kskonly yes;</strong></span> zone option in 350 <span><strong class="command">named</strong></span>.) 351 </p></dd> 352<dt><span class="term">-z</span></dt> 353<dd><p> 354 Ignore KSK flag on key when determining what to sign. This 355 causes KSK-flagged keys to sign all records, not just the 356 DNSKEY RRset. (This is similar to the 357 <span><strong class="command">update-check-ksk no;</strong></span> zone option in 358 <span><strong class="command">named</strong></span>.) 359 </p></dd> 360<dt><span class="term">-3 <em class="replaceable"><code>salt</code></em></span></dt> 361<dd><p> 362 Generate an NSEC3 chain with the given hex encoded salt. 363 A dash (<em class="replaceable"><code>salt</code></em>) can 364 be used to indicate that no salt is to be used when generating the NSEC3 chain. 365 </p></dd> 366<dt><span class="term">-H <em class="replaceable"><code>iterations</code></em></span></dt> 367<dd><p> 368 When generating an NSEC3 chain, use this many interations. The 369 default is 10. 370 </p></dd> 371<dt><span class="term">-A</span></dt> 372<dd> 373<p> 374 When generating an NSEC3 chain set the OPTOUT flag on all 375 NSEC3 records and do not generate NSEC3 records for insecure 376 delegations. 377 </p> 378<p> 379 Using this option twice (i.e., <code class="option">-AA</code>) 380 turns the OPTOUT flag off for all records. This is useful 381 when using the <code class="option">-u</code> option to modify an NSEC3 382 chain which previously had OPTOUT set. 383 </p> 384</dd> 385<dt><span class="term">zonefile</span></dt> 386<dd><p> 387 The file containing the zone to be signed. 388 </p></dd> 389<dt><span class="term">key</span></dt> 390<dd><p> 391 Specify which keys should be used to sign the zone. If 392 no keys are specified, then the zone will be examined 393 for DNSKEY records at the zone apex. If these are found and 394 there are matching private keys, in the current directory, 395 then these will be used for signing. 396 </p></dd> 397</dl></div> 398</div> 399<div class="refsect1" lang="en"> 400<a name="id2672553"></a><h2>EXAMPLE</h2> 401<p> 402 The following command signs the <strong class="userinput"><code>example.com</code></strong> 403 zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span> 404 (Kexample.com.+003+17247). Because the <span><strong class="command">-S</strong></span> option 405 is not being used, the zone's keys must be in the master file 406 (<code class="filename">db.example.com</code>). This invocation looks 407 for <code class="filename">dsset</code> files, in the current directory, 408 so that DS records can be imported from them (<span><strong class="command">-g</strong></span>). 409 </p> 410<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \ 411Kexample.com.+003+17247 412db.example.com.signed 413%</pre> 414<p> 415 In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates 416 the file <code class="filename">db.example.com.signed</code>. This 417 file should be referenced in a zone statement in a 418 <code class="filename">named.conf</code> file. 419 </p> 420<p> 421 This example re-signs a previously signed zone with default parameters. 422 The private keys are assumed to be in the current directory. 423 </p> 424<pre class="programlisting">% cp db.example.com.signed db.example.com 425% dnssec-signzone -o example.com db.example.com 426db.example.com.signed 427%</pre> 428</div> 429<div class="refsect1" lang="en"> 430<a name="id2672632"></a><h2>SEE ALSO</h2> 431<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>, 432 <em class="citetitle">BIND 9 Administrator Reference Manual</em>, 433 <em class="citetitle">RFC 4033</em>. 434 </p> 435</div> 436<div class="refsect1" lang="en"> 437<a name="id2672657"></a><h2>AUTHOR</h2> 438<p><span class="corpauthor">Internet Systems Consortium</span> 439 </p> 440</div> 441</div> 442<div class="navfooter"> 443<hr> 444<table width="100%" summary="Navigation footer"> 445<tr> 446<td width="40%" align="left"> 447<a accesskey="p" href="man.dnssec-settime.html">Prev</a>�</td> 448<td width="20%" align="center"><a accesskey="u" href="Bv9ARM.ch10.html">Up</a></td> 449<td width="40%" align="right">�<a accesskey="n" href="man.named-checkconf.html">Next</a> 450</td> 451</tr> 452<tr> 453<td width="40%" align="left" valign="top"> 454<span class="application">dnssec-settime</span>�</td> 455<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td> 456<td width="40%" align="right" valign="top">�<span class="application">named-checkconf</span> 457</td> 458</tr> 459</table> 460</div> 461</body> 462</html> 463