WEBDIENSTE/NLnetLabs-dnst
1
0
Fork 0
mirror of https://github.com/NLnetLabs/dnst.git synced 2026-09-13 13:27:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update generated keyset manual page.

Browse Source
This commit is contained in:
Philip Homburg
2026-03-02 14:05:20 +01:00
parent fae293c24a
commit dceda51698
1 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/manual/build/man/dnst-keyset.1
+20 -6
View File
@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.TH "DNST-KEYSET" "1" "Feb 16, 2026" "0.1.1-dev" "dnst"
.TH "DNST-KEYSET" "1" "Mar 02, 2026" "0.1.1-dev" "dnst"
.SH NAME
dnst-keyset \- Manage DNSSEC signing keys for a domain
.SH SYNOPSIS
@@ -240,6 +240,15 @@ steps must be done manually in order to be able to insert extra manual steps.
.sp
The \fBreport\fP and \fBdone\fP automations require that keyset has network access
to all nameservers of the zone and all nameservers of the parent.
.sp
The configuration variables \fBautoremove\fP and \fBautoremove\-delay\fP
control the automatic removal of keys that are no longer needed.
The variable \fBautoremove\fP defaults to false.
In this case, stale keys have to be removed manually.
When \fBautoremove\fP is set to true, the \fBcron\fP subcommand checks if any
keys have been stale for at least \fBautoremove\-delay\fP, and if so, removes
those keys.
The \fBautoremove\-delay\fP variable defaults to one week.
.SS HSM Support (KMIP)
.sp
The keyset subcommand supports keys in Hardware Security Modules (HSM) through
@@ -283,9 +292,9 @@ case new keys will be created by keyset and stored as files.
.sp
Authentication can be done either with a user name and password or with
a client\-side certificate.
The user name and password are KMIP concepts that are mapped by the kmip2pkcs11
server to a PKCS #11 slot or token name and the PIN.
With this approach the kmip2pkcs11 server des not have to store secrets
The user name and password are KMIP concepts that are mapped by the
cascade\-hsm\-bridge server to a PKCS #11 slot or token name and the PIN.
With this approach the cascade\-hsm\-bridge server des not have to store secrets
that provide access to the HSM.
User names and passwords are stored in a separate file to avoid storing
secrets in the keyset configuration or state files.
@@ -685,7 +694,8 @@ Give detailed information about all keys in the key set.
get
.sp
Get the values of the following configuration variables: use\-csk,
autoremove, algorithm, ds\-algorithm, dnskey\-lifetime, cds\-lifetime.
autoremove, autoremove\-delay, algorithm, ds\-algorithm, dnskey\-lifetime,
cds\-lifetime.
This is a subset of all configuration variables.
.sp
Additionally, the dnskey argument returns the current DNSKEY RRset plus
@@ -707,7 +717,11 @@ will be created.
autoremove <BOOLEAN>
.sp
When true, keys that are stale will be removed automatically.
Currently there is no delay in removing keys.
.IP \(bu 2
autoremove\-delay <DELAY>
.sp
Set the delay between the time keys become stale and automatic
removal.
.IP \(bu 2
algorithm <ALGORITHM>
.sp