Update repub branch u/fanf2/patch to rebasing branch u/fanf2/rebasing revision v9_15_...
[ipreg/bind9.git] / bin / dnssec / dnssec-revoke.html
CommitLineData
63fe88e8 1<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
cfb1587e 2<!--
b4d3f782 3 - Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
bef75d63 4 -
6807a2dc
TU
5 - This Source Code Form is subject to the terms of the Mozilla Public
6 - License, v. 2.0. If a copy of the MPL was not distributed with this
7 - file, You can obtain one at http://mozilla.org/MPL/2.0/.
cfb1587e 8-->
63fe88e8 9<html lang="en">
cfb1587e
EH
10<head>
11<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
12<title>dnssec-revoke</title>
fd2597f7 13<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
cfb1587e 14</head>
fd2597f7 15<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
cfb1587e 16<a name="man.dnssec-revoke"></a><div class="titlepage"></div>
16fde7f0
TU
17
18
19
20
21
22 <div class="refnamediv">
cfb1587e 23<h2>Name</h2>
16fde7f0
TU
24<p>
25 <span class="application">dnssec-revoke</span>
26 &#8212; set the REVOKED bit on a DNSSEC key
27 </p>
cfb1587e 28</div>
16fde7f0
TU
29
30
31
32 <div class="refsynopsisdiv">
cfb1587e 33<h2>Synopsis</h2>
16fde7f0
TU
34 <div class="cmdsynopsis"><p>
35 <code class="command">dnssec-revoke</code>
36 [<code class="option">-hr</code>]
37 [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
38 [<code class="option">-V</code>]
39 [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
40 [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
41 [<code class="option">-f</code>]
42 [<code class="option">-R</code>]
43 {keyfile}
44 </p></div>
45 </div>
46
47 <div class="refsection">
fd2597f7 48<a name="id-1.7"></a><h2>DESCRIPTION</h2>
16fde7f0
TU
49
50 <p><span class="command"><strong>dnssec-revoke</strong></span>
cfb1587e 51 reads a DNSSEC key file, sets the REVOKED bit on the key as defined
fd0b768f
AU
52 in RFC 5011, and creates a new pair of key files containing the
53 now-revoked key.
cfb1587e 54 </p>
16fde7f0
TU
55 </div>
56
57 <div class="refsection">
fd2597f7 58<a name="id-1.8"></a><h2>OPTIONS</h2>
16fde7f0
TU
59
60
61 <div class="variablelist"><dl class="variablelist">
0ae35ecf 62<dt><span class="term">-h</span></dt>
16fde7f0
TU
63<dd>
64 <p>
0ae35ecf 65 Emit usage message and exit.
16fde7f0
TU
66 </p>
67 </dd>
0a7ed886 68<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
16fde7f0
TU
69<dd>
70 <p>
cfb1587e 71 Sets the directory in which the key files are to reside.
16fde7f0
TU
72 </p>
73 </dd>
0ae35ecf 74<dt><span class="term">-r</span></dt>
16fde7f0
TU
75<dd>
76 <p>
0ae35ecf
AU
77 After writing the new keyset files remove the original keyset
78 files.
16fde7f0
TU
79 </p>
80 </dd>
cfb1587e 81<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
16fde7f0
TU
82<dd>
83 <p>
cfb1587e 84 Sets the debugging level.
16fde7f0
TU
85 </p>
86 </dd>
6f120589 87<dt><span class="term">-V</span></dt>
16fde7f0
TU
88<dd>
89 <p>
6f120589 90 Prints version information.
16fde7f0
TU
91 </p>
92 </dd>
8ec3c085 93<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
6ea23853 94<dd>
16fde7f0 95 <p>
6ea23853
TU
96 Specifies the cryptographic hardware to use, when applicable.
97 </p>
16fde7f0 98 <p>
6ea23853
TU
99 When BIND is built with OpenSSL PKCS#11 support, this defaults
100 to the string "pkcs11", which identifies an OpenSSL engine
101 that can drive a cryptographic accelerator or hardware service
102 module. When BIND is built with native PKCS#11 cryptography
103 (--enable-native-pkcs11), it defaults to the path of the PKCS#11
104 provider library specified via "--with-pkcs11".
105 </p>
16fde7f0 106 </dd>
0ae35ecf 107<dt><span class="term">-f</span></dt>
16fde7f0
TU
108<dd>
109 <p>
2eeb74d1 110 Force overwrite: Causes <span class="command"><strong>dnssec-revoke</strong></span> to
cfb1587e
EH
111 write the new key pair even if a file already exists matching
112 the algorithm and key ID of the revoked key.
16fde7f0
TU
113 </p>
114 </dd>
12bfbed8 115<dt><span class="term">-R</span></dt>
16fde7f0
TU
116<dd>
117 <p>
12bfbed8
AU
118 Print the key tag of the key with the REVOKE bit set but do
119 not revoke the key.
16fde7f0
TU
120 </p>
121 </dd>
cfb1587e 122</dl></div>
16fde7f0
TU
123 </div>
124
125 <div class="refsection">
fd2597f7 126<a name="id-1.9"></a><h2>SEE ALSO</h2>
16fde7f0
TU
127
128 <p><span class="citerefentry">
129 <span class="refentrytitle">dnssec-keygen</span>(8)
130 </span>,
cfb1587e
EH
131 <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
132 <em class="citetitle">RFC 5011</em>.
133 </p>
16fde7f0
TU
134 </div>
135
cfb1587e
EH
136</div></body>
137</html>