dnssec-signkey(1m)

1dnssec-signkey(1M)      System Administration Commands      dnssec-signkey(1M)
2
3
4

NAME

6       dnssec-signkey - DNSSEC key set signing tool
7

SYNOPSIS

9       dnssec-signkey [-ahp] [-c class] [-e end-time]
10            [-r randomdev] [-s start-time] [-v level] keyset key...
11
12

DESCRIPTION

14       The dnssec-signkey utility signs a keyset. Typically the keyset will be
15       for a child zone and will have been generated by dnssec-makekeyset(1M).
16       The  child  zone's  keyset  is signed with the zone keys for its parent
17       zone. The output file is of the form signedkey-nnnn., where nnnn is the
18       zone name.
19

OPTIONS

21       The following options are supported:
22
23       -a               Verify all generated signatures.
24
25
26       -c class         Specify the DNS class of the key sets.
27
28
29       -e end-time      Specify  the  date  and  time  when  the generated SIG
30                        records expire. As with start-time, an  absolute  time
31                        is  indicated in YYYYMMDDHHMMSS notation. A time rela‐
32                        tive to the start time is indicated with +N, which  is
33                        N  seconds from the start time. A time relative to the
34                        current time is indicated with now+N. If  no  end-time
35                        is specified, 30 days from the start time is used as a
36                        default.
37
38
39       -h               Prints a short summary of the options and arguments to
40                        dnssec-signkey().
41
42
43       -p               Use  pseudo-random data when signing the zone. This is
44                        faster, but less secure, than using real random  data.
45                        This  option may be useful when signing large zones or
46                        when the entropy source is limited.
47
48
49       -r randomdev     Specify the source of  randomness.  If  the  operating
50                        system  does  not  provide a /dev/random or equivalent
51                        device, the default source of randomness  is  keyboard
52                        input.  randomdev  specifies  the  name of a character
53                        device or file  containing  random  data  to  be  used
54                        instead  of  the  default.  The special value keyboard
55                        indicates that keyboard input should be used.
56
57
58       -s start-time    Specify the date  and  time  when  the  generated  SIG
59                        records  become  valid. This can be either an absolute
60                        or relative time. An absolute start time is  indicated
61                        by a number in YYYYMMDDHHMMSS notation; 20000530144500
62                        denotes 14:45:00 UTC on May  30th,  2000.  A  relative
63                        start time is indicated by +N, which is N seconds from
64                        the current time. If no start-time is  specified,  the
65                        current time is used.
66
67
68       -v level         Set the debugging level.
69
70

OPERANDS

72       The following operands are supported:
73
74       key       The keys used to sign the child's keyset.
75
76
77       keyset    The file containing the child's keyset.
78
79

EXAMPLES

81       Example 1 Sign the keyset file for example.com.
82
83
84       The  DNS  administrator for a DNSSEC-aware .com zone would use the fol‐
85       lowing command to sign the  keyset  file  for  example.com  created  by
86       dnssec-makekeyset with a key generated by dnssec-keygen:
87
88
89         dnssec-signkey keyset-example.com. Kcom.+003+51944
90
91
92
93
94       In this example, dnssec-signkey creates the file signedkey-example.com,
95       which contains the example.com keys and  the  signatures  by  the  .com
96       keys.
97
98

ATTRIBUTES

100       See attributes(5) for descriptions of the following attributes:
101
102
103
104
105       ┌───────────────────────────────────────────────────────────┐
106       │      ATTRIBUTE TYPE                ATTRIBUTE VALUE        │
107       │Availability                  SUNWbind9                    │
108       │Interface Stability           External                     │
109       └───────────────────────────────────────────────────────────┘
110

NOTES

116       Source for BIND9 is available in the SUNWbind9S package.
117
118
119
120SunOS 5.11                        20 Mar 2007               dnssec-signkey(1M)