FreeBSD Manual Pages
DNSSEC-KSR(1) BIND 9 DNSSEC-KSR(1) NAME dnssec-ksr - create signed key response (SKR) files for offline KSK setups SYNOPSIS dnssec-ksr [-E engine] [-e date/offset] [-F] [-f file] [-h] [-i date/off- set] [-K directory] [-k policy] [-l file] [-o] [-V] [-v level] {command} {zone} DESCRIPTION The dnssec-ksr can be used to issue several commands that are needed to generate presigned RRsets for a zone where the private key file of the Key Signing Key (KSK) is typically offline. This requires Zone Signing Keys (ZSKs) to be pregenerated, and the DNSKEY, CDNSKEY, and CDS RRsets to be already signed in advance. The latter is done by creating Key Signing Requests (KSRs) that can be im- ported to the environment where the KSK is available. Once there, this pro- gram can create Signed Key Responses (SKRs) that can be loaded by an au- thoritative DNS server. OPTIONS -E engine This option specifies the cryptographic hardware to use, when ap- plicable. When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL engine identifier that drives the cryptographic accelerator or hardware service module (usually pkcs11). -e date/offset This option sets the end date for which keys or SKRs need to be gen- erated (depending on the command). -F This options turns on FIPS (US Federal Information Processing Stan- dards) mode if the underlying crytographic library supports running in FIPS mode. -f This option sets the SKR file to be signed when issuing a sign com- mand. -h This option prints a short summary of the options and arguments to dnssec-ksr. -i date/offset This option sets the start date for which keys or SKRs need to be generated (depending on the command). -K directory This option sets the directory in which the key files are to be read or written (depending on the command). -k policy This option sets the specific dnssec-policy for which keys need to be generated, or signed. -l file This option provides a configuration file that contains a dnssec-policy statement (matching the policy set with -k). -o Normally when pregenerating keys, ZSKs are created. When this option is set, create KSKs instead. -V This option prints version information. -v level This option sets the debugging level. Level 1 is intended to be use- fully verbose for general users; higher levels are intended for de- velopers. command The KSR command to be executed. See below for the available commands. zone The name of the zone for which the KSR command is being executed. COMMANDS keygen Pregenerate a number of keys, given a DNSSEC policy and an interval. The number of generated keys depends on the interval and the key lifetime. request Create a Key Signing Request (KSR), given a DNSSEC policy and an in- terval. This will generate a file with a number of key bundles, where each bundle contains the currently published ZSKs (according to the timing metadata). sign Sign a Key Signing Request (KSR), given a DNSSEC policy and an in- terval, creating a Signed Key Response (SKR). This will add the cor- responding DNSKEY, CDS, and CDNSKEY records for the KSK that is be- ing used for signing. EXIT STATUS The dnssec-ksr command exits 0 on success, or non-zero if an error oc- curred. EXAMPLES When you need to generate ZSKs for the zone "example.com" for the next year, given a dnssec-policy named "mypolicy": dnssec-ksr -i now -e +1y -k mypolicy -l named.conf keygen example.com Creating a KSR for the same zone and period can be done with: dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt Typically you would now transfer the KSR to the system that has access to the KSK. Signing the KSR created above can be done with: dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com Make sure that the DNSSEC parameters in kskpolicy match those in mypolicy. SEE ALSO dnssec-keygen(8) <#std-iscman-dnssec-keygen>, dnssec-signzone(8) <# std-iscman-dnssec-signzone>, BIND 9 Administrator Reference Manual. Author Internet Systems Consortium Copyright 2026, Internet Systems Consortium 9.20.26 2026-07-20 DNSSEC-KSR(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | COMMANDS | EXIT STATUS | EXAMPLES | SEE ALSO | Author | Copyright
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=dnssec-ksr&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>