DNSSEC-MAKEKEYSET(8)                         DNSSEC-MAKEKEYSET(8)



NAME
       dnssec-makekeyset - DNSSEC zone signing tool

SYNOPSIS
       dnssec-makekeyset [ -a ]  [ -s start-time ]  [ -e end-time
       ]  [ -h ]  [ -p ]  [ -r randomdev ]  [ -tttl ]  [ -v level
       ]  key...

DESCRIPTION
       dnssec-makekeyset  generates  a  key  set from one or more
       keys created by dnssec-keygen. It creates a file  contain-
       ing  a KEY record for each key, and self-signs the key set
       with each zone key. The output file is of the form keyset-
       nnnn., where nnnn is the zone name.

OPTIONS
       -a     Verify all generated signatures.

       -s start-time
              Specify  the  date  and time when the generated SIG
              records become valid. This can be either  an  abso-
              lute  or  relative  time. An absolute start time is
              indicated by a number in  YYYYMMDDHHMMSS  notation;
              20000530144500  denotes  14:45:00  UTC on May 30th,
              2000. A relative start time  is  indicated  by  +N,
              which  is  N  seconds from the current time.  If no
              start-time is specified, the current time is  used.

       -e end-time
              Specify  the  date  and time when the generated SIG
              records expire. As  with  start-time,  an  absolute
              time  is  indicated  in  YYYYMMDDHHMMSS notation. A
              time relative to the start time is  indicated  with
              +N,  which is N seconds from the start time. A time
              relative to the  current  time  is  indicated  with
              now+N.  If  no  end-time is specified, 30 days from
              the start time is used as a default.

       -h     Prints a short summary of the options and arguments
              to dnssec-makekeyset.

       -p     Use  pseudo-random data when signing the zone. This
              is faster, but less secure, than using real  random
              data.  This option may be useful when signing large
              zones or when the entropy source is limited.

       -r randomdev
              Specifies the source of randomness. If the  operat-
              ing system does not provide a /dev/random or equiv-
              alent device, the default source of  randomness  is
              keyboard  input.  randomdev specifies the name of a
              character device or file containing random data  to
              be  used  instead of the default. The special value
              keyboard indicates that keyboard  input  should  be
              used.

       -t ttl Specify  the  TTL (time to live) of the KEY and SIG
              records.  The default is 3600 seconds.

       -v level
              Sets the debugging level.

       key    The list of keys to be included in the keyset file.
              These    keys    are    expressed   in   the   form
              Knnnn.+aaa+iiiii as generated by dnssec-keygen.

EXAMPLE
       The following command generates a  keyset  containing  the
       DSA key for example.com generated in the dnssec-keygen man
       page.

       dnssec-makekeyset -t 86400 -s 20000701120000  -e  +2592000
       Kexample.com.+003+26160

       In  this  example, dnssec-makekeyset creates the file key-
       set-example.com.. This file contains the specified key and
       a self-generated signature.

       The  DNS  administrator for example.com could send keyset-
       example.com. to the DNS administrator for .com  for  sign-
       ing,  if the .com zone is DNSSEC-aware and the administra-
       tors of the two zones have some mechanism for authenticat-
       ing  each  other  and  exchanging  the keys and signatures
       securely.

SEE ALSO
       dnssec-keygen(8), dnssec-signkey(8), BIND 9  Administrator
       Reference Manual, RFC 2535.

AUTHOR
       Internet Software Consortium



BIND9                     June 30, 2000      DNSSEC-MAKEKEYSET(8)