dns-key¶
The following operations can be performed on "dns-key":
add| create| set| unset| rm| show| import|
add dns key¶
Adds a DNS key to the zone that is specified in the key file.
Synopsis¶
add dns key <keyName> <publickey> <privatekey> [-expires <positive_integer> [<units>]] [-notificationPeriod <positive_integer> [<units>]] [-TTL <secs>] {-password }
Arguments¶
keyName
Name of the public-private key pair to publish in the zone.
publickey
File name of the public key.
privatekey
File name of the private key.
expires
Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767
units
Units for the expiry period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
notificationPeriod
Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm. Default value: 7 Minimum value: 1 Maximum value: 32767
units
Units for the notification period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
TTL
Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used. Default value: 3600 Maximum value: 2147483647
password
Passphrase for reading the encrypted public/private DNS keys
Example¶
add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private
create dns key¶
Creates a public-private key pair to use for signing a DNS zone. The keys are created in the /nsconfig/dns/ directory on the Citrix ADC. The private, pubic, and DS key files are created with names having the format ..
Synopsis¶
create dns key -zoneName <string> -keyType <keyType> -algorithm RSASHA1 -keySize <positive_integer> -fileNamePrefix <string> {-password }
Arguments¶
zoneName
Name of the zone for which to create a key.
keyType
Type of key to create.
Possible values: KSK, KeySigningKey, ZSK, ZoneSigningKey Default value: NS_DNSKEY_ZSK
algorithm
Algorithm to generate for zone signing.
Possible values: RSASHA1 Default value: NS_DNSKEYALGO_RSASHA1
keySize
Size of the key, in bits. Default value: 512 Minimum value: 1 Maximum value: 4096
fileNamePrefix
Common prefix for the names of the generated public and private key files and the Delegation Signer (DS) resource record. During key generation, the .key, .private, and .ds suffixes are appended automatically to the file name prefix to produce the names of the public key, the private key, and the DS record, respectively.
password
Passphrase for reading the encrypted public/private DNS keys
Example¶
create dns key -zone dnssec.bar -algorithm RSASHA1 -keySize 1024
set dns key¶
Modifies the specified parameters of a DNS key. Note: If you change the expiry time period of a key, the Citrix ADC, using the modified key, automatically re-signs all the resource records in the zone, provided that the zone is currently signed with the particular key.
Synopsis¶
set dns key <keyName> [-expires <positive_integer> [<units>]] [-notificationPeriod <positive_integer> [<units>]] [-TTL <secs>]
Arguments¶
keyName
Name of the public-private key pair.
expires
Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767
units
Units for the expiry period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
notificationPeriod
Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm. Default value: 7 Minimum value: 1 Maximum value: 32767
units
Units for the notification period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
TTL
Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used. Default value: 3600 Maximum value: 2147483647
Example¶
add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private
unset dns key¶
Use this command to remove dns key settings.Refer to the set dns key command for meanings of the arguments.
Synopsis¶
unset dns key <keyName> [-expires] [-units] [-notificationPeriod] [-units] [-TTL]
rm dns key¶
Removes a DNS key.
Synopsis¶
rm dns key <keyName>
Arguments¶
keyName
Name of the public-private key pair.
Example¶
rm dns key secure.example.zsk
show dns key¶
Displays the parameters of the specified DNS key. If no DNS key name is specified, all configured DNS keys are shown. Note: You cannot view the parameters of a public/private key file. You can view the parameters of a key after you have published it in a DNS zone by using either the add dns key command or the DNS > Zones > Sign/Unsign DNS Zone dialog box.
Synopsis¶
show dns key [<keyName>]
Arguments¶
keyName
Name of the public-private key pair.
Output¶
publickey
File name of the public key.
privatekey
File name of the private key.
expires
Number of days since signing with this key, when the key expires.
units
Units for the expiry period.
notificationPeriod
Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm.
units
Units for the notification period.
TTL
Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used.
zoneName
Name of the zone for which the key is created.
password
Passphrase for reading the encrypted public/private DNS keys
devno
count
stateflag
Example¶
show dns key
import dns key¶
Import the DNSSEC key.
Synopsis¶
import dns key <keyName> -src <URL>
Arguments¶
keyName
Name of the public-private key pair to publish in the zone.
src
URL (protocol, host, path, and file name) from where the DNS key file will be imported. NOTE: The import fails if the object to be imported is on an HTTPS server that requires client certificate authentication for access. This is a mandatory argument