- -3
Use an NSEC3-capable algorithm to generate a DNSSEC key.
If this option is used with an algorithm that has both
NSEC and NSEC3 versions, then the NSEC3 version will be
used; for example, dnssec-keygen -3a RSASHA1
specifies the NSEC3RSASHA1 algorithm.
- -a
algorithm
-
Selects the cryptographic algorithm. For DNSSEC keys, the value
of algorithm must be one of RSAMD5, RSASHA1,
DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
For TSIG/TKEY, the value must
be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. These values are
case insensitive.
If no algorithm is specified, then RSASHA1 will be used by
default, unless the -3 option is specified,
in which case NSEC3RSASHA1 will be used instead. (If
-3 is used and an algorithm is specified,
that algorithm will be checked for compatibility with NSEC3.)
Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
algorithm, and DSA is recommended. For TSIG, HMAC-MD5 is
mandatory.
Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
automatically set the -T KEY option.
- -b
keysize
-
Specifies the number of bits in the key. The choice of key
size depends on the algorithm used. RSA keys must be
between 512 and 2048 bits. Diffie Hellman keys must be between
128 and 4096 bits. DSA keys must be between 512 and 1024
bits and an exact multiple of 64. HMAC keys must be
between 1 and 512 bits. Elliptic curve algorithms don't need
this parameter.
The key size does not need to be specified if using a default
algorithm. The default key size is 1024 bits for zone signing
keys (ZSKs) and 2048 bits for key signing keys (KSKs,
generated with -f KSK). However, if an
algorithm is explicitly specified with the -a,
then there is no default key size, and the -b
must be used.
- -C
Compatibility mode: generates an old-style key, without any
timing metadata. By default, dnssec-keygen
will include the key's creation date in the metadata stored with
the private key, and other dates may be set there as well
(publication date, activation date, etc). Keys that include this
data may be incompatible with older versions of BIND; the
-C option suppresses them.
- -c
class
Indicates that the DNS record containing the key should have
the specified class. If not specified, class IN is used.
- -E
engine
-
Specifies the cryptographic hardware to use, when applicable.
When BIND is built with OpenSSL PKCS#11 support, this defaults
to the string "pkcs11", which identifies an OpenSSL engine
that can drive a cryptographic accelerator or hardware service
module. When BIND is built with native PKCS#11 cryptography
(--enable-native-pkcs11), it defaults to the path of the PKCS#11
provider library specified via "--with-pkcs11".
- -f
flag
Set the specified flag in the flag field of the KEY/DNSKEY record.
The only recognized flags are KSK (Key Signing Key) and REVOKE.
- -G
Generate a key, but do not publish it or sign with it. This
option is incompatible with -P and -A.
- -g
generator
If generating a Diffie Hellman key, use this generator.
Allowed values are 2 and 5. If no generator
is specified, a known prime from RFC 2539 will be used
if possible; otherwise the default is 2.
- -h
Prints a short summary of the options and arguments to
dnssec-keygen.
- -K
directory
Sets the directory in which the key files are to be written.
- -k
Deprecated in favor of -T KEY.
- -L
ttl
Sets the default TTL to use for this key when it is converted
into a DNSKEY RR. If the key is imported into a zone,
this is the TTL that will be used for it, unless there was
already a DNSKEY RRset in place, in which case the existing TTL
would take precedence. If this value is not set and there
is no existing DNSKEY RRset, the TTL will default to the
SOA TTL. Setting the default TTL to 0
or none is the same as leaving it unset.
- -n
nametype
Specifies the owner type of the key. The value of
nametype must either be ZONE (for a DNSSEC
zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
with a host (KEY)), USER (for a key associated with a
user(KEY)) or OTHER (DNSKEY). These values are case
insensitive. Defaults to ZONE for DNSKEY generation.
- -p
protocol
Sets the protocol value for the generated key, for use
with -T KEY. The protocol is a number between 0
and 255. The default is 3 (DNSSEC). Other possible values for
this argument are listed in RFC 2535 and its successors.
- -q
Quiet mode: Suppresses unnecessary output, including
progress indication. Without this option, when
dnssec-keygen is run interactively
to generate an RSA or DSA key pair, it will print a string
of symbols to stderr indicating the
progress of the key generation. A '.' indicates that a
random number has been found which passed an initial
sieve test; '+' means a number has passed a single
round of the Miller-Rabin primality test; a space
means that the number has passed all the tests and is
a satisfactory key.
- -r
randomdev
Specifies the source of randomness. If the operating
system does not provide a /dev/random
or equivalent device, the default source of randomness
is keyboard input. randomdev
specifies
the name of a character device or file containing random
data to be used instead of the default. The special value
keyboard indicates that keyboard
input should be used.
- -S
key
Create a new key which is an explicit successor to an
existing key. The name, algorithm, size, and type of the
key will be set to match the existing key. The activation
date of the new key will be set to the inactivation date of
the existing one. The publication date will be set to the
activation date minus the prepublication interval, which
defaults to 30 days.
- -s
strength
Specifies the strength value of the key. The strength is
a number between 0 and 15, and currently has no defined
purpose in DNSSEC.
- -T
rrtype
-
Specifies the resource record type to use for the key.
rrtype must be either DNSKEY or KEY. The
default is DNSKEY when using a DNSSEC algorithm, but it can be
overridden to KEY for use with SIG(0).
Using any TSIG algorithm (HMAC-* or DH) forces this option
to KEY.
- -t
type
Indicates the use of the key, for use with -T
KEY. type must be one of AUTHCONF,
NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
refers to the ability to authenticate data, and CONF the ability
to encrypt data.
- -V
Prints version information.
- -v
level
Sets the debugging level.