ldns-keygen(1)

📦
version 1.9.2 · 4 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ ldns-keygen — bestie, it's a whole DNSSEC key generator ✨

okay so welcome to ldns-keygen(1), a general commands manual page, and honestly? she's iconic. sit down, grab a strawberry 🍓, and let's get you generating key pairs like the main character you are.

💖 NAME 💖

ldns-keygen — generate a DNSSEC key pair 🎀

🌸 SYNOPSIS 🌸

ldns-keygen [ OPTION ] DOMAIN

like. that's it. that's the whole vibe check. one domain, some options, go off. 💅

🦋 DESCRIPTION 🦋

so ldns-keygen is the girl who makes a private/public keypair for you. when you run her, she's gonna create 3 files, no more no less:

  • a .key file with the public DNSKEY 🔑
  • a .private file with the private keydata 🤫
  • a .ds file with the DS record of the DNSKEY record 📜

slay.

she can also be used to create symmetric keys (for TSIG, iykyk) — you just pick the right algorithm and she switches modes. the ones that do this:

  • hmac-md5.sig-alg.reg.int
  • hmac-sha1
  • hmac-sha224
  • hmac-sha256
  • hmac-sha384
  • hmac-sha512
🚨 in that case, no DS record will be created and no .ds file. periodt. don't go looking for it, she didn't make one.

and then, the moment you've been waiting for: ldns-keygen prints the basename for the key files, and it looks like this:

K<name>+<alg>+<id>

no cap, that's the name she hands back to you. 🫶

✨ OPTIONS ✨

  • -a <algorithm> — create a key with this algorithm, bestie. if you literally just write list here, she'll give you a list of supported algorithms. several alias names are also accepted (from older versions and other software, we don't judge 🙈), and the list she shows you gives names from the RFC. also? the plain algo number is accepted. yes really. 💅
  • -b <bits> — use this many bits for the key length. that's it, that's the tea. ☕
  • -k — when you give her this, she generates a key signing key. and honestly it's lowkey a one-line change: this just sets the flag field to 257 instead of 256 in the DNSKEY RR in the .key file. tiny flag, big energy. 👑
  • -r device — make ldns-keygen use this file to seed the random generator with. it defaults to /dev/random. keep her fed, she needs the entropy 🌈
  • -s — she'll create symbolic links named .private (pointing to the new generated private key), .key (pointing to the public DNSKEY) and .ds (pointing to the file containing DS record data). symlink era 🔗
  • -f — force symlinks to be overwritten if they exist. she's not asking permission, she's just doing it. 💀
  • -v — show the version and exit. quick lil peek, then she's out. 🧚

💜 AUTHOR 💜

Written by the ldns team as an example for ldns usage. honestly? they ate. 🫶

🎀 REPORTING BUGS 🎀

found a bug? not on her watch, but also she needs to know. report bugs to <dns-team@nlnetlabs.nl>. be nice, she's trying her best 😭

Copyright (C) 2005-2008 NLnet Labs. This is free software. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

🚨 bestie read that again: NO warranty. not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. like, at all. she said what she said. 💀

and that's the page, babe. 🌈✨ this was ldns-keygen(1), dated 27 May 2008, from the ldns crew — go forth and generate keys, you absolute legend. 🦋💖🎀

📦 where this page comes from