From: Evan Hunt Date: Tue, 9 Jun 2009 02:47:43 +0000 (+0000) Subject: update man page for dnssec-signzone X-Git-Tag: v9.6.1-P1^2^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9cd3264af886c9ef60aa91d63b1612b9a4972bd5;p=thirdparty%2Fbind9.git update man page for dnssec-signzone --- diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index 017d7881bd7..9e4b00f563d 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -14,12 +14,12 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + dnssec-signzone - + @@ -50,7 +50,7 @@

dnssec-signzone [-a] [-c class] [-d directory] [-e end-time] [-f output-file] [-g] [-h] [-k key] [-l domain] [-i interval] [-I input-format] [-j jitter] [-N soa-serial-format] [-o origin] [-O output-format] [-p] [-r randomdev] [-s start-time] [-t] [-v level] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]

-

DESCRIPTION

+

DESCRIPTION

dnssec-signzone signs a zone. It generates NSEC and RRSIG records and produces a signed version of the @@ -61,7 +61,7 @@

-

OPTIONS

+

OPTIONS

-a

@@ -276,7 +276,7 @@

-

EXAMPLE

+

EXAMPLE

The following command signs the example.com zone with the DSA key generated by dnssec-keygen @@ -305,14 +305,39 @@ db.example.com.signed %

-

SEE ALSO

+

KNOWN BUGS

+

+ dnssec-signzone was designed so that it could + sign a zone partially, using only a subset of the DNSSEC keys + needed to produce a fully-signed zone. This permits a zone + administrator, for example, to sign a zone with one key on one + machine, move the resulting partially-signed zone to a second + machine, and sign it again with a second key. +

+

+ An unfortunate side-effect of this flexibility is that + dnssec-signzone does not check to make sure + it's signing a zone with any valid keys at all. An attempt to + sign a zone without any keys will appear to succeed, producing + a "signed" zone with no signatures. There is no warning issued + when a zone is not fully signed. +

+

+ This will be corrected in a future release. In the meantime, ISC + recommends examining the output of dnssec-signzone + to confirm that the zone is properly signed by all keys before + using it. +

+
+
+

SEE ALSO

dnssec-keygen(8), BIND 9 Administrator Reference Manual, RFC 4033.

-

AUTHOR

+

AUTHOR

Internet Systems Consortium