From dceda516984892442dfcd222dd07c61bbbf5c097 Mon Sep 17 00:00:00 2001 From: Philip Homburg Date: Mon, 2 Mar 2026 14:05:20 +0100 Subject: [PATCH] Update generated keyset manual page. --- doc/manual/build/man/dnst-keyset.1 | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/doc/manual/build/man/dnst-keyset.1 b/doc/manual/build/man/dnst-keyset.1 index 17bc7c5..45c3b28 100644 --- a/doc/manual/build/man/dnst-keyset.1 +++ b/doc/manual/build/man/dnst-keyset.1 @@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. -.TH "DNST-KEYSET" "1" "Feb 16, 2026" "0.1.1-dev" "dnst" +.TH "DNST-KEYSET" "1" "Mar 02, 2026" "0.1.1-dev" "dnst" .SH NAME dnst-keyset \- Manage DNSSEC signing keys for a domain .SH SYNOPSIS @@ -240,6 +240,15 @@ steps must be done manually in order to be able to insert extra manual steps. .sp The \fBreport\fP and \fBdone\fP automations require that keyset has network access to all nameservers of the zone and all nameservers of the parent. +.sp +The configuration variables \fBautoremove\fP and \fBautoremove\-delay\fP +control the automatic removal of keys that are no longer needed. +The variable \fBautoremove\fP defaults to false. +In this case, stale keys have to be removed manually. +When \fBautoremove\fP is set to true, the \fBcron\fP subcommand checks if any +keys have been stale for at least \fBautoremove\-delay\fP, and if so, removes +those keys. +The \fBautoremove\-delay\fP variable defaults to one week. .SS HSM Support (KMIP) .sp The keyset subcommand supports keys in Hardware Security Modules (HSM) through @@ -283,9 +292,9 @@ case new keys will be created by keyset and stored as files. .sp Authentication can be done either with a user name and password or with a client\-side certificate. -The user name and password are KMIP concepts that are mapped by the kmip2pkcs11 -server to a PKCS #11 slot or token name and the PIN. -With this approach the kmip2pkcs11 server des not have to store secrets +The user name and password are KMIP concepts that are mapped by the +cascade\-hsm\-bridge server to a PKCS #11 slot or token name and the PIN. +With this approach the cascade\-hsm\-bridge server des not have to store secrets that provide access to the HSM. User names and passwords are stored in a separate file to avoid storing secrets in the keyset configuration or state files. @@ -685,7 +694,8 @@ Give detailed information about all keys in the key set. get .sp Get the values of the following configuration variables: use\-csk, -autoremove, algorithm, ds\-algorithm, dnskey\-lifetime, cds\-lifetime. +autoremove, autoremove\-delay, algorithm, ds\-algorithm, dnskey\-lifetime, +cds\-lifetime. This is a subset of all configuration variables. .sp Additionally, the dnskey argument returns the current DNSKEY RRset plus @@ -707,7 +717,11 @@ will be created. autoremove .sp When true, keys that are stale will be removed automatically. -Currently there is no delay in removing keys. +.IP \(bu 2 +autoremove\-delay +.sp +Set the delay between the time keys become stale and automatic +removal. .IP \(bu 2 algorithm .sp