ADC CLI Commands

dns-key

The following operations can be performed on “dns-key”:

create set import show rm unset add

create dns key

Creates a public-private key pair to use for signing a DNS zone. The keys are created in the /nsconfig/dns/ directory on the Citrix ADC. The private, pubic, and DS key files are created with names having the format .<key/private/ds>.

Synopsis

create dns key -zoneName -keyType -algorithm -keySize -fileNamePrefix {-password }

Arguments

zoneName Name of the zone for which to create a key.

keyType Type of key to create.

Possible values: KSK, KeySigningKey, ZSK, ZoneSigningKey Default value: NS_DNSKEY_ZSK

algorithm Algorithm to generate for zone signing.

Possible values: RSASHA1, RSASHA256, RSASHA512 Default value: NS_DNSKEYALGO_RSASHA1

keySize Size of the key, in bits. Default value: 512 Minimum value: 1 Maximum value: 4096

fileNamePrefix Common prefix for the names of the generated public and private key files and the Delegation Signer (DS) resource record. During key generation, the .key, .private, and .ds suffixes are appended automatically to the file name prefix to produce the names of the public key, the private key, and the DS record, respectively.

password Passphrase for reading the encrypted public/private DNS keys

Example

create dns key -zone dnssec.bar -algorithm RSASHA1 -keySize 1024

set dns key

Modifies the specified parameters of a DNS key. Note: If you change the expiry time period of a key, the Citrix ADC, using the modified key, automatically re-signs all the resource records in the zone, provided that the zone is currently signed with the particular key.

Synopsis

set dns key [-expires []] [-notificationPeriod []] [-TTL ]

Arguments

keyName Name of the public-private key pair.

expires Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767

units Units for the expiry period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

notificationPeriod Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm. Default value: 7 Minimum value: 1 Maximum value: 32767

units Units for the notification period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

TTL Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone’s minimum TTL or the default value of 3600 is used. Default value: 3600 Maximum value: 2147483647

Example

add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private

import dns key

Import the DNSSEC key.

Synopsis

import dns key -src

Arguments

keyName Name of the public-private key pair to publish in the zone.

src URL (protocol, host, path, and file name) from where the DNS key file will be imported. NOTE: The import fails if the object to be imported is on an HTTPS server that requires client certificate authentication for access. This is a mandatory argument

show dns key

Displays the parameters of the specified DNS key. If no DNS key name is specified, all configured DNS keys are shown. Note: You cannot view the parameters of a public/private key file. You can view the parameters of a key after you have published it in a DNS zone by using either the add dns key command or the DNS > Zones > Sign/Unsign DNS Zone dialog box.

Synopsis

show dns key []

Arguments

keyName Name of the public-private key pair.

Output

publickey File name of the public key.

privatekey File name of the private key.

expires Number of days since signing with this key, when the key expires.

units Units for the expiry period.

notificationPeriod Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm.

units Units for the notification period.

TTL Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone’s minimum TTL or the default value of 3600 is used.

zoneName Name of the zone for which the key is created.

password Passphrase for reading the encrypted public/private DNS keys

devno count stateflag

Example

show dns key

rm dns key

Removes a DNS key.

Synopsis

rm dns key

Arguments

keyName Name of the public-private key pair.

Example

rm dns key secure.example.zsk

unset dns key

Use this command to remove dns key settings.Refer to the set dns key command for meanings of the arguments.

Synopsis

unset dns key [-expires] [-units] [-notificationPeriod] [-units] [-TTL]

add dns key

Adds a DNS key to the zone that is specified in the key file.

Synopsis

add dns key [-expires []] [-notificationPeriod []] [-TTL ] {-password }

Arguments

keyName Name of the public-private key pair to publish in the zone.

publickey File name of the public key.

privatekey File name of the private key.

expires Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767

units Units for the expiry period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

notificationPeriod Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm. Default value: 7 Minimum value: 1 Maximum value: 32767

units Units for the notification period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

TTL Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone’s minimum TTL or the default value of 3600 is used. Default value: 3600 Maximum value: 2147483647

password Passphrase for reading the encrypted public/private DNS keys

Example

add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private

dns-key