Clarify dnssec-keyfromlabel -a in man page

(cherry picked from commit 5f53003dae4d65dffab7d9c0f906242aa26ceabc)

diff --git a/bin/dnssec/dnssec-keyfromlabel.rst b/bin/dnssec/dnssec-keyfromlabel.rst
index 635a9cf63dc7e0c805a375ab48ded63377616e95..57ab9c81a2c412a30369d544af0ecc02a266e306 100644 (file)
--- a/bin/dnssec/dnssec-keyfromlabel.rst
+++ b/bin/dnssec/dnssec-keyfromlabel.rst
@@ -42,20 +42,16 @@ Options
    be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
    ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
 
-   If no algorithm is specified, RSASHA1 is used by default
-   unless the ``-3`` option is specified, in which case NSEC3RSASHA1
-   is used instead. (If ``-3`` is used and an algorithm is
-   specified, that algorithm is checked for compatibility with
-   NSEC3.)
-
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
    ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
    option, then NSEC3RSASHA1 is used instead.
 
-   Since BIND 9.12.0, this option is mandatory except when using the
+   This option is mandatory except when using the
    ``-S`` option, which copies the algorithm from the predecessory key.
-   Previously, the default for newly generated keys was RSASHA1.
+
+   .. versionchanged:: 9.12.0
+      The default value RSASHA1 for newly generated keys was removed.
 
 ``-3``
    This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this

diff --git a/doc/man/dnssec-keyfromlabel.8in b/doc/man/dnssec-keyfromlabel.8in
index 1fbd8ba29e2fbb80ef632b69ea310cd46d1ad15d..475927077e818ccf7a58a86ab5d224fad05b4384 100644 (file)
--- a/doc/man/dnssec-keyfromlabel.8in
+++ b/doc/man/dnssec-keyfromlabel.8in
@@ -52,20 +52,16 @@ This option selects the cryptographic algorithm. The value of \fBalgorithm\fP mu
 be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
 ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
 .sp
-If no algorithm is specified, RSASHA1 is used by default
-unless the \fB\-3\fP option is specified, in which case NSEC3RSASHA1
-is used instead. (If \fB\-3\fP is used and an algorithm is
-specified, that algorithm is checked for compatibility with
-NSEC3.)
-.sp
 These values are case\-insensitive. In some cases, abbreviations are
 supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
 ECDSAP384SHA384. If RSASHA1 is specified along with the \fB\-3\fP
 option, then NSEC3RSASHA1 is used instead.
 .sp
-Since BIND 9.12.0, this option is mandatory except when using the
+This option is mandatory except when using the
 \fB\-S\fP option, which copies the algorithm from the predecessory key.
-Previously, the default for newly generated keys was RSASHA1.
+.sp
+Changed in version 9.12.0: The default value RSASHA1 for newly generated keys was removed.
+
 .TP
 .B \fB\-3\fP
 This option uses an NSEC3\-capable algorithm to generate a DNSSEC key. If this