1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 .. highlight: console 13 14 .. iscman:: dnssec-importkey 15 .. program:: dnssec-importkey 16 .. _man_dnssec-importkey: 17 18 dnssec-importkey - import DNSKEY records from external systems so they can be managed 19 ------------------------------------------------------------------------------------- 20 21 Synopsis 22 ~~~~~~~~ 23 24 :program:`dnssec-importkey` [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] {keyfile} 25 26 :program:`dnssec-importkey` {**-f** filename} [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** sync date/offset] [**-D** date/offset] [**-D** sync date/offset] [**-h**] [**-v** level] [**-V**] [dnsname] 27 28 Description 29 ~~~~~~~~~~~ 30 31 :program:`dnssec-importkey` reads a public DNSKEY record and generates a pair 32 of .key/.private files. The DNSKEY record may be read from an 33 existing .key file, in which case a corresponding .private file is 34 generated, or it may be read from any other file or from the standard 35 input, in which case both .key and .private files are generated. 36 37 The newly created .private file does *not* contain private key data, and 38 cannot be used for signing. However, having a .private file makes it 39 possible to set publication (:option:`-P`) and deletion (:option:`-D`) times for the 40 key, which means the public key can be added to and removed from the 41 DNSKEY RRset on schedule even if the true private key is stored offline. 42 43 When using ``dnssec-policy``, do not use :program:`dnssec-importkey` to 44 import key files that cannot be used for signing. In this case, simply publish the 45 imported DNSKEY record in the zone, and make sure that the files are outside 46 the configured ``key-directory``. 47 48 Options 49 ~~~~~~~ 50 51 .. option:: -f filename 52 53 This option indicates the zone file mode. Instead of a public keyfile name, the argument is the 54 DNS domain name of a zone master file, which can be read from 55 ``filename``. If the domain name is the same as ``filename``, then it may be 56 omitted. 57 58 If ``filename`` is set to ``"-"``, then the zone data is read from the 59 standard input. 60 61 .. option:: -K directory 62 63 This option sets the directory in which the key files are to reside. 64 65 .. option:: -L ttl 66 67 This option sets the default TTL to use for this key when it is converted into a 68 DNSKEY RR. This is the TTL used when the key is imported into a zone, 69 unless there was already a DNSKEY RRset in 70 place, in which case the existing TTL takes precedence. Setting the default TTL to ``0`` or ``none`` 71 removes it from the key. 72 73 .. option:: -h 74 75 This option emits a usage message and exits. 76 77 .. option:: -v level 78 79 This option sets the debugging level. 80 81 .. option:: -V 82 83 This option prints version information. 84 85 Timing Options 86 ~~~~~~~~~~~~~~ 87 88 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. 89 (which is the format used inside key files), 90 or 'Day Mon DD HH:MM:SS YYYY' (as printed by ``dnssec-settime -p``), 91 or UNIX epoch time (as printed by ``dnssec-settime -up``), 92 or the literal ``now``. 93 94 The argument can be followed by ``+`` or ``-`` and an offset from the 95 given time. The literal ``now`` can be omitted before an offset. The 96 offset can be followed by one of the suffixes ``y``, ``mo``, ``w``, 97 ``d``, ``h``, or ``mi``, so that it is computed in years (defined as 98 365 24-hour days, ignoring leap years), months (defined as 30 24-hour 99 days), weeks, days, hours, or minutes, respectively. Without a suffix, 100 the offset is computed in seconds. 101 102 To explicitly prevent a date from being set, use ``none``, ``never``, 103 or ``unset``. 104 105 All these formats are case-insensitive. 106 107 .. option:: -P date/offset 108 109 This option sets the date on which a key is to be published to the zone. After 110 that date, the key is included in the zone but is not used 111 to sign it. 112 113 .. program:: dnssec-importkey -P 114 .. option:: sync date/offset 115 116 This option sets the date on which CDS and CDNSKEY records that match this key 117 are to be published to the zone. 118 119 .. program:: dnssec-importkey 120 121 .. option:: -D date/offset 122 123 This option sets the date on which the key is to be deleted. After that date, the 124 key is no longer included in the zone. (However, it may remain in the key 125 repository.) 126 127 .. program:: dnssec-importkey -D 128 .. option:: sync date/offset 129 130 This option sets the date on which the CDS and CDNSKEY records that match this 131 key are to be deleted. 132 133 .. program:: dnssec-importkey 134 135 136 Files 137 ~~~~~ 138 139 A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii`` 140 or the full file name ``Knnnn.+aaa+iiiii.key``, as generated by 141 :iscman:`dnssec-keygen`. 142 143 See Also 144 ~~~~~~~~ 145 146 :iscman:`dnssec-keygen(8) <dnssec-keygen>`, :iscman:`dnssec-signzone(8) <dnssec-signzone>`, BIND 9 Administrator Reference Manual, 147 :rfc:`5011`. 148
Indexes created Wed Mar 04 05:31:52 UTC 2026