dns-key¶
The following operations can be performed on "dns-key":
unset| create| show| set| rm| import| add|
unset dns key¶
Use this command to remove dns key settings.Refer to the set dns key command for meanings of the arguments.
Synopsis¶
unset dns key
create dns key¶
Creates a public-private key pair to use for signing a DNS zone. The keys are created in the /nsconfig/dns/ directory on the Citrix ADC. The private, pubic, and DS key files are created with names having the format ###Synopsis
create dns key -zoneName
Arguments¶
zoneName Name of the zone for which to create a key.
keyType Type of key to create.
Possible values: KSK, KeySigningKey, ZSK, ZoneSigningKey Default value: NS_DNSKEY_ZSK
algorithm Algorithm to generate for zone signing.
Possible values: RSASHA1, RSASHA256, RSASHA512 Default value: NS_DNSKEYALGO_RSASHA1
keySize Size of the key, in bits. Default value: 512 Minimum value: 1 Maximum value: 4096
fileNamePrefix Common prefix for the names of the generated public and private key files and the Delegation Signer (DS) resource record. During key generation, the .key, .private, and .ds suffixes are appended automatically to the file name prefix to produce the names of the public key, the private key, and the DS record, respectively.
password Passphrase for reading the encrypted public/private DNS keys
Example¶
create dns key -zone dnssec.bar -algorithm RSASHA1 -keySize 1024
show dns key¶
Displays the parameters of the specified DNS key. If no DNS key name is specified, all configured DNS keys are shown. Note: You cannot view the parameters of a public/private key file. You can view the parameters of a key after you have published it in a DNS zone by using either the add dns key command or the DNS > Zones > Sign/Unsign DNS Zone dialog box.
Synopsis¶
show dns key [
Arguments¶
keyName Name of the public-private key pair.
Output¶
publickey File name of the public key.
privatekey File name of the private key.
expires Number of days since signing with this key, when the key expires.
units Units for the expiry period.
notificationPeriod Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm.
units Units for the notification period.
TTL Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used.
zoneName Name of the zone for which the key is created.
password Passphrase for reading the encrypted public/private DNS keys
devno count stateflag
Example¶
show dns key
set dns key¶
Modifies the specified parameters of a DNS key. Note: If you change the expiry time period of a key, the Citrix ADC, using the modified key, automatically re-signs all the resource records in the zone, provided that the zone is currently signed with the particular key.
Synopsis¶
set dns key
Arguments¶
keyName Name of the public-private key pair.
expires Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767
units Units for the expiry period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
notificationPeriod Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm. Default value: 7 Minimum value: 1 Maximum value: 32767
units Units for the notification period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
TTL Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used. Default value: 3600 Maximum value: 2147483647
Example¶
add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private
rm dns key¶
Removes a DNS key.
Synopsis¶
rm dns key
Arguments¶
keyName Name of the public-private key pair.
Example¶
rm dns key secure.example.zsk
import dns key¶
Import the DNSSEC key.
Synopsis¶
import dns key
Arguments¶
keyName Name of the public-private key pair to publish in the zone.
src URL (protocol, host, path, and file name) from where the DNS key file will be imported. NOTE: The import fails if the object to be imported is on an HTTPS server that requires client certificate authentication for access. This is a mandatory argument
add dns key¶
Adds a DNS key to the zone that is specified in the key file.
Synopsis¶
add dns key
Arguments¶
keyName Name of the public-private key pair to publish in the zone.
publickey File name of the public key.
privatekey File name of the private key.
expires Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767
units Units for the expiry period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
notificationPeriod Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm. Default value: 7 Minimum value: 1 Maximum value: 32767
units Units for the notification period.
Possible values: MINUTES, HOURS, DAYS Default value: DAYS
TTL Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone's minimum TTL or the default value of 3600 is used. Default value: 3600 Maximum value: 2147483647
password Passphrase for reading the encrypted public/private DNS keys
Example¶
add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/secure.example-rsasha1-1024.private