From: Mark Andrews Date: Tue, 22 Mar 2005 04:58:13 +0000 (+0000) Subject: regen X-Git-Tag: v9.2.6b1~137^2~22 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=bcab20b2f591f92c2aa88fd853c0b741b5545c12;p=thirdparty%2Fbind9.git regen --- diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8 index 8d5bbfbf2e8..7f17bdf0e39 100644 --- a/bin/dnssec/dnssec-signzone.8 +++ b/bin/dnssec/dnssec-signzone.8 @@ -13,14 +13,14 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-signzone.8,v 1.32 2004/06/11 03:03:12 marka Exp $ +.\" $Id: dnssec-signzone.8,v 1.33 2005/03/22 04:58:13 marka Exp $ .\" .TH "DNSSEC-SIGNZONE" "8" "June 30, 2000" "BIND9" "" .SH NAME dnssec-signzone \- DNSSEC zone signing tool .SH SYNOPSIS .sp -\fBdnssec-signzone\fR [ \fB-a\fR ] [ \fB-c \fIclass\fB\fR ] [ \fB-d \fIdirectory\fB\fR ] [ \fB-e \fIend-time\fB\fR ] [ \fB-f \fIoutput-file\fB\fR ] [ \fB-g\fR ] [ \fB-h\fR ] [ \fB-k \fIkey\fB\fR ] [ \fB-l \fIdomain\fB\fR ] [ \fB-i \fIinterval\fB\fR ] [ \fB-n \fInthreads\fB\fR ] [ \fB-o \fIorigin\fB\fR ] [ \fB-p\fR ] [ \fB-r \fIrandomdev\fB\fR ] [ \fB-s \fIstart-time\fB\fR ] [ \fB-t\fR ] [ \fB-v \fIlevel\fB\fR ] [ \fB-z\fR ] \fBzonefile\fR [ \fBkey\fR\fI...\fR ] +\fBdnssec-signzone\fR [ \fB-a\fR ] [ \fB-c \fIclass\fB\fR ] [ \fB-d \fIdirectory\fB\fR ] [ \fB-e \fIend-time\fB\fR ] [ \fB-f \fIoutput-file\fB\fR ] [ \fB-g\fR ] [ \fB-h\fR ] [ \fB-k \fIkey\fB\fR ] [ \fB-l \fIdomain\fB\fR ] [ \fB-i \fIinterval\fB\fR ] [ \fB-j \fIjitter\fB\fR ] [ \fB-n \fInthreads\fB\fR ] [ \fB-o \fIorigin\fB\fR ] [ \fB-p\fR ] [ \fB-r \fIrandomdev\fB\fR ] [ \fB-s \fIstart-time\fB\fR ] [ \fB-t\fR ] [ \fB-v \fIlevel\fB\fR ] [ \fB-z\fR ] \fBzonefile\fR [ \fBkey\fR\fI...\fR ] .SH "DESCRIPTION" .PP \fBdnssec-signzone\fR signs a zone. It generates @@ -98,6 +98,23 @@ interval of 7.5 days. Therefore, if any existing RRSIG records are due to expire in less than 7.5 days, they would be replaced. .TP +\fB\fR +When signing a zone with a fixed signature lifetime, all +RRSIG records issued at the time of signing expires +simultaneously. If the zone is incrementally signed, i.e. +a previously signed zone is passed as input to the signer, +all expired signatures has to be regenerated at about the +same time. The \fBjitter\fR option specifies a +jitter window that will be used to randomize the signature +expire time, thus spreading incremental signature +regeneration over time. + +Signature lifetime jitter also to some extent benefits +validators and servers by spreading out cache expiration, +i.e. if large numbers of RRSIGs don't expire at the same time +from all caches there will be less congestion than if all +validators need to refetch at mostly the same time. +.TP \fB-n \fIncpus\fB\fR Specifies the number of threads to use. By default, one thread is started for each detected CPU. diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html index 4994039db56..58bde7ed348 100644 --- a/bin/dnssec/dnssec-signzone.html +++ b/bin/dnssec/dnssec-signzone.html @@ -15,7 +15,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + ] [-j jitter] [-n nthreads

DESCRIPTION

OPTIONS

When signing a zone with a fixed signature lifetime, all + RRSIG records issued at the time of signing expires + simultaneously. If the zone is incrementally signed, i.e. + a previously signed zone is passed as input to the signer, + all expired signatures has to be regenerated at about the + same time. The jitter option specifies a + jitter window that will be used to randomize the signature + expire time, thus spreading incremental signature + regeneration over time. +

Signature lifetime jitter also to some extent benefits + validators and servers by spreading out cache expiration, + i.e. if large numbers of RRSIGs don't expire at the same time + from all caches there will be less congestion than if all + validators need to refetch at mostly the same time. +

-n ncpus

EXAMPLE

SEE ALSO

AUTHOR