Product Documentation

dns key

Sep 12, 2016

The following operations can be performed on "dns key":

add | create | set | unset | rm | show

add dns key

Adds a DNS key to the zone that is specified in the key file.

Synopsys

add dns key <keyName> <publickey> <privatekey> [-expires <positive_integer> [<units>]] [-notificationPeriod <positive_integer> [<units>]] [-TTL <secs>]

Arguments

keyName

Name of the public-private key pair to publish in the zone.

publickey

File name of the public key.

privatekey

File name of the private key.

expires

Time period for which to consider the key valid, after the key is used to sign a zone.

Default value: 120

Minimum value: 1

Maximum value: 32767

units

Units for the notification period.

Possible values: MINUTES, HOURS, DAYS

Default value: DAYS

notificationPeriod

Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm.

Default value: 7

Minimum value: 1

Maximum value: 32767

TTL

Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used.

Default value: 3600

Maximum value: 2147483647

Example

add dns key secure.example.zsk  -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private

create dns key

Creates a public-private key pair to use for signing a DNS zone. The keys are created in the /nsconfig/dns/ directory on the NetScaler appliance. The private, pubic, and DS key files are created with names having the format <prefix>.<key/private/ds>.

Synopsys

create dns key -zoneName <string> -keyType <keyType> -algorithm RSASHA1 -keySize <positive_integer> -fileNamePrefix <string>

Arguments

zoneName

Name of the zone for which to create a key.

keyType

Type of key to create.

Possible values: KSK, KeySigningKey, ZSK, ZoneSigningKey

Default value: NS_DNSKEY_ZSK

algorithm

Algorithm to generate for zone signing.

Possible values: RSASHA1

Default value: NS_DNSKEYALGO_RSASHA1

keySize

Size of the key, in bits.

Default value: 512

Minimum value: 0

fileNamePrefix

Common prefix for the names of the generated public and private key files and the Delegation Signer (DS) resource record. During key generation, the .key, .private, and .ds suffixes are appended automatically to the file name prefix to produce the names of the public key, the private key, and the DS record, respectively.

Example

create dns key -zone dnssec.bar -algorithm RSASHA1 -keySize 1024

set dns key

Modifies the specified parameters of a DNS key. Note: If you change the expiry time period of a key, the NetScaler appliance, using the modified key, automatically re-signs all the resource records in the zone, provided that the zone is currently signed with the particular key.

Synopsys

set dns key <keyName> [-expires <positive_integer> [<units>]] [-notificationPeriod <positive_integer> [<units>]] [-TTL <secs>]

Arguments

keyName

Name of the public-private key pair.

expires

Time period for which to consider the key valid, after the key is used to sign a zone.

Default value: 120

Minimum value: 1

Maximum value: 32767

units

Units for the notification period.

Possible values: MINUTES, HOURS, DAYS

Default value: DAYS

notificationPeriod

Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm.

Default value: 7

Minimum value: 1

Maximum value: 32767

TTL

Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used.

Default value: 3600

Maximum value: 2147483647

Example

add dns key secure.example.zsk  -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private

unset dns key

Use this command to remove dns key settings.Refer to the set dns key command for meanings of the arguments.

Synopsys

unset dns key <keyName> [-expires] [-units] [-notificationPeriod] [-units] [-TTL]

rm dns key

Removes a DNS key.

Synopsys

rm dns key <keyName>

Arguments

keyName

Name of the public-private key pair.

Example

rm dns key secure.example.zsk

show dns key

Displays the parameters of the specified DNS key. If no DNS key name is specified, all configured DNS keys are shown. Note: You cannot view the parameters of a public/private key file. You can view the parameters of a key after you have published it in a DNS zone by using either the add dns key command or the DNS > Zones > Sign/Unsign DNS Zone dialog box.

Synopsys

show dns key [<keyName>]

Arguments

keyName

Name of the public-private key pair.

Outputs

publickey

File name of the public key.

privatekey

File name of the private key.

expires

Number of days since signing with this key, when the key expires.

units

Units for the notification period.

notificationPeriod

Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm.

TTL

Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used.

zoneName

Name of the zone for which the key is created.

devno

count

stateflag

Example

show dns key