From: Libor Peltan <libor.peltan@nic.cz>
Date: Fri, 23 Feb 2018 13:43:33 +0000 (+0100)
Subject: doc: clarified KSK role and SEP flag
X-Git-Tag: v2.7.0~177^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e55592d9577ee26b6c28105483bf8ff6e582ca46;p=thirdparty%2Fknot-dns.git

doc: clarified KSK role and SEP flag
---

diff --git a/doc/man/keymgr.8in b/doc/man/keymgr.8in
index d9171dacf8..d1e3b0bbca 100644
--- a/doc/man/keymgr.8in
+++ b/doc/man/keymgr.8in
@@ -127,10 +127,11 @@ Either an algorithm number (e.g. 14), or text name without dashes (e.g. ECDSAP38
 Key length in bits.
 .TP
 \fBksk\fP
-If set to \fByes\fP, the key will be used as Secure Entry Point.
+If set to \fByes\fP, the key will be used for signing DNSKEY rrset. The generated key will also
+have the Secure Entry Point flag set to 1.
 .TP
 \fBzsk\fP
-If set to \fByes\fP, the key will be used for zone signing. This flag can
+If set to \fByes\fP, the key will be used for signing zone (except DNSKEY rrset). This flag can
 be set concurrently with the \fBksk\fP flag.
 .TP
 \fBcreated\fP
diff --git a/doc/man_keymgr.rst b/doc/man_keymgr.rst
index 891faf3804..f716fe4374 100644
--- a/doc/man_keymgr.rst
+++ b/doc/man_keymgr.rst
@@ -104,10 +104,11 @@ Arguments are separated by space, each of them is in format 'name=value'.
   Key length in bits.
 
 **ksk**
-  If set to **yes**, the key will be used as Secure Entry Point.
+  If set to **yes**, the key will be used for signing DNSKEY rrset. The generated key will also
+  have the Secure Entry Point flag set to 1.
 
 **zsk**
-  If set to **yes**, the key will be used for zone signing. This flag can
+  If set to **yes**, the key will be used for signing zone (except DNSKEY rrset). This flag can
   be set concurrently with the **ksk** flag.
 
 **created**