DNS_KEYTYPE_NOKEY is only applicable to KEY

(cherry picked from commit 53c6721abc49746d91e61a5bb2cbbea24d64dd72)

diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 7e6d2d30dc48a425d9185c55d4d8bc0c29ec592d..44008bbce5a777c51a7991319813a88a8da2b7ca 100644 (file)
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -631,7 +631,9 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
                break;
        }
 
-       if ((flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY) {
+       if ((flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY &&
+           (ctx->options & DST_TYPE_KEY) != 0)
+       {
                null_key = true;
        }