GENKRF(1)

📦
version 2.2.3 · 2 versions
, in fedora 43

💖 GENKRF(1) — the genkrf glow-up 💖

okay bestie, come closer — this is genkrf, a lil' Perl tool from the DNSSEC-Tools world, and she's here to generate a keyrec file from your KSK and/or ZSK files. yes she's that girl. ✨

🌸 NAME 🌸

genkrf — Generate a keyrec file from Key Signing Key (KSK) and/or Zone Signing Key (ZSK) files. literally her whole job, no cap. 💅

🦋 SYNOPSIS 🦋

genkrf [options] <zone-file> [<signed-zone-file>]

✨ DESCRIPTION ✨

so here's the tea, bestie 🍓: genkrf generates a keyrec file from KSK and/or ZSK files. and if you need new keys? she'll generate new KSK and ZSK keys too. she's proactive like that. 👑

the name of the keyrec file she's gonna generate is given by the -krfile option. if you don't specify that option, then zone-name.krf gets used as the name of the keyrec file. and okay, heads up 🙈 — if the keyrec file already exists, it will be overwritten with new keyrec definitions. like, gone. new keyrec energy only.

the zone-file argument is required. it specifies the name of the zone file from which the signed zone file was created. the optional signed-zone-file argument specifies the name of the signed zone file. if you don't give it, then it defaults to zone-file.signed. and ngl the signed zone file field is, in effect, a dummy field — because the zone file is not actually signed. it's giving decorative. 🎀

🌈 OPTIONS 🌈

genkrf has a number of options that assist in creation of the keyrec file. these options will be set to the first value found from this search path:

command line options
DNSSEC-Tools configuration file
DNSSEC-Tools defaults

see tooloptions.pm(3) for more details. exceptions to this are given in the option descriptions, iykyk.

the genkrf options are described below. buckle up. 🫶

💜 General genkrf Options 💜

  • -zone zone-name — this option specifies the name of the zone. if it's not given, then zone-file will be used as the name of the zone.
  • -krfile keyrec-file — this option specifies the name of the keyrec file to be generated. if it's not given, then zone-name.krf will be used.
  • -algorithm algorithm — this option specifies the algorithm used to generate encryption keys. 🔐
  • -endtime endtime — this option specifies the time that the signature on the zone expires, measured in seconds. ⏰
  • -random random-device — source of randomness used to generate the zone's keys. see the man page for dnssec-signzone for the valid format of this field. 🎲
  • -verbose — display additional messages during processing. if this option is given at least once, then a message will be displayed indicating the successful generation of the keyrec file. if it's given twice, then the values of all options will also be displayed. double the flag, double the lore. 👀
  • -Version — displays the version information for genkrf and the DNSSEC-Tools package.
  • -help — display a usage message. we love a helper. 🫶
  • -kskcur KSK-name — this option specifies the Current KSK's key file being used to sign the zone. if this option isn't given, a new KSK will be created. slay, new key.
  • -kskcount KSK-count — this option specifies the number of KSK keys that will be generated. if it isn't given, the default given in the DNSSEC-Tools configuration file will be used.
  • -kskdir KSK-directory — this option specifies the absolute or relative path of the directory where the KSK resides. if it isn't given, it defaults to the current directory ".".
  • -ksklength KSK-length — this option specifies the length of the KSK encryption key. 📏
  • -ksklife KSK-lifespan — this option specifies the lifespan of the KSK encryption key. and bestie, listen: this lifespan is not inherent to the key itself. it's only used to determine when the KSK must be rolled over. it's giving calendar reminder, not personality trait. 💅
  • -zskcur ZSK-name — this option specifies the current ZSK being used to sign the zone. if this option isn't given, a new ZSK will be created.
  • -zskpub ZSK-name — this option specifies the published ZSK for the zone. if this option isn't given, a new ZSK will be created. (yes, again. she's generous.)
  • -zskcount ZSK-count — this option specifies the number of current and published ZSK keys that will be generated. if it isn't given, the default given in the DNSSEC-Tools configuration file will be used.
  • -zskdir ZSK-directory — this option specifies the absolute or relative path of the directory where the ZSKs reside. if it isn't given, it defaults to the current directory ".".
  • -zsklength ZSK-length — this option specifies the length of the ZSK encryption key. 📏
  • -zsklife ZSK-lifespan — this option specifies the lifespan of the ZSK encryption key. and same deal as before, fr fr: this lifespan is not inherent to the key itself. it's only used to determine when the ZSK must be rolled over.

Copyright 2005-2014 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

💌 AUTHOR 💌

Wayne Morrison, tewok@tislabs.com

🔗 SEE ALSO 🔗

and that's the whole page, bestie — mwah, go generate those keyrec files 💖✨

this page is from the DNSSEC-Tools collection, written under perl v5.42.0, dated 2025-07-23 — and the man page itself goes by GENKRF(1). periodt. 💅

📦 where this page comes from