ADC CLI Commands

dns-key

May 28, 2024

Contributed by:

The following operations can be performed on “dns-key”:

set dns key

Modifies the specified parameters of a DNS key. Note: If you change the expiry time period of a key, the Citrix ADC, using the modified key, automatically re-signs all the resource records in the zone, provided that the zone is currently signed with the particular key.

Synopsis

set dns key \[-expires <positive\_integer> \[]] \[-notificationPeriod <positive\_integer> \[]] \[-TTL ] \[-autoRollover \( ENABLED | DISABLED )] \[-RolloverMethod ] \[-revoke]

Arguments

keyName Name of the public-private key pair.

expires Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767

units Units for the expiry period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

notificationPeriod Time at which to generate notification of key expiration, specified as number of days, hours, or minutes before expiry. Must be less than the expiry period. The notification is an SNMP trap sent to an SNMP manager. To enable the appliance to send the trap, enable the DNSKEY-EXPIRY SNMP alarm. In case autorollover option is enabled, rollover for successor key will be intiated at this time. No notification trap will be sent. Default value: 7 Minimum value: 1 Maximum value: 32767

units Units for the notification period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

TTL Time to Live (TTL), in seconds, for the DNSKEY resource record created in the zone. TTL is the time for which the record must be cached by the DNS proxies. If the TTL is not specified, either the DNS zone’s minimum TTL or the default value of 3600 is used. Default value: 3600 Maximum value: 2147483647

autoRollover Flag to enable/disable key rollover automatically. Note:

Key name will be appended with _AR1 for successor key. For e.g. current key=k1, successor key=k1_AR1.
Key name can be truncated if current name length is more than 58 bytes to accomodate the suffix.

Possible values: ENABLED, DISABLED Default value: DISABLED

RolloverMethod Method used for automatic rollover.

Key type: ZSK, Method: PrePublication or DoubleSignature.
Key type: KSK, Method: DoubleRRSet.

Possible values: PrePublication, DoubleSignature, DoubleRRSet

revoke Revoke the key. Note: This operation is non-reversible.

Example

set dns key secure.example.zsk -autoRollover ENABLED -expires 30 days -notificationPeriod 10 days -RolloverMethod PrePublication -TTL 60

import dns key

Import the DNSSEC key.

Synopsis

import dns key -src

Arguments

keyName Name of the public-private key pair to publish in the zone.

src URL (protocol, host, path, and file name) from where the DNS key file will be imported. NOTE: The import fails if the object to be imported is on an HTTPS server that requires client certificate authentication for access. This is a mandatory argument

add dns key

Adds a DNS key to the zone that is specified in the key file.

Synopsis

add dns key \[-expires <positive\_integer> \[]] \[-notificationPeriod <positive\_integer> \[]] \[-TTL ] {-password } \[-autoRollover \( ENABLED | DISABLED )] \[-RolloverMethod ] \[-revoke]

Arguments

keyName Name of the public-private key pair to publish in the zone.

publickey File name of the public key.

privatekey File name of the private key.

expires Time period for which to consider the key valid, after the key is used to sign a zone. Default value: 120 Minimum value: 1 Maximum value: 32767

units Units for the expiry period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

units Units for the notification period.

Possible values: MINUTES, HOURS, DAYS Default value: DAYS

password Passphrase for reading the encrypted public/private DNS keys

autoRollover Flag to enable/disable key rollover automatically. Note:

Key name will be appended with _AR1 for successor key. For e.g. current key=k1, successor key=k1_AR1.
Key name can be truncated if current name length is more than 58 bytes to accomodate the suffix.

Possible values: ENABLED, DISABLED Default value: DISABLED

RolloverMethod Method used for automatic rollover.

Key type: ZSK, Method: PrePublication or DoubleSignature.
Key type: KSK, Method: DoubleRRSet.

Possible values: PrePublication, DoubleSignature, DoubleRRSet

revoke Revoke the key. Note: This operation is non-reversible.

Example

add dns key secure.example.zsk secure.example-rsasha1-1024.key secure.example-rsasha1-1024.private -autoRollover ENABLED -expires 120 days -notificationPeriod 30 days

rm dns key

Removes a DNS key.

Synopsis

rm dns key

Arguments

keyName Name of the public-private key pair.

Example

rm dns key secure.example.zsk

create dns key

Creates a public-private key pair to use for signing a DNS zone. The keys are created in the /nsconfig/dns/ directory on the Citrix ADC. The private, pubic, and DS key files are created with names having the format ###Synopsis

create dns key -zoneName -keyType -algorithm -keySize -fileNamePrefix {-password }

Arguments

zoneName Name of the zone for which to create a key.

keyType Type of key to create.

Possible values: KSK, KeySigningKey, ZSK, ZoneSigningKey Default value: ZSK

algorithm Algorithm to generate the key.

Possible values: RSASHA1, RSASHA256, RSASHA512 Default value: NS_DNSKEYALGO_RSASHA1

keySize Size of the key, in bits. Default value: 512 Minimum value: 1 Maximum value: 4096

fileNamePrefix Common prefix for the names of the generated public and private key files and the Delegation Signer (DS) resource record. During key generation, the .key, .private, and .ds suffixes are appended automatically to the file name prefix to produce the names of the public key, the private key, and the DS record, respectively.

password Passphrase for reading the encrypted public/private DNS keys

Example

create dns key -zone dnssec.bar -keyType ZSK -algorithm RSASHA1 -keySize 1024 -fileNamePrefix keyfile

show dns key

Displays the parameters of the specified DNS key. If no DNS key name is specified, all configured DNS keys are shown. Note: You cannot view the parameters of a public/private key file. You can view the parameters of a key after you have published it in a DNS zone by using either the add dns key command or the DNS > Zones > Sign/Unsign DNS Zone dialog box.

Synopsis

show dns key []

Arguments

keyName Name of the public-private key pair.

Output

publickey File name of the public key.

privatekey File name of the private key.

expires Number of days since signing with this key, when the key expires.

units Units for the expiry period.

units Units for the notification period.

zoneName Name of the zone for which the key is created.

password Passphrase for reading the encrypted public/private DNS keys

autoRollover Flag to enable/disable key rollover automatically. Note:

Key name will be appended with _AR1 for successor key. For e.g. current key=k1, successor key=k1_AR1.
Key name can be truncated if current name length is more than 58 bytes to accomodate the suffix.

RolloverMethod Method used for automatic rollover.

Key type: ZSK, Method: PrePublication or DoubleSignature.
Key type: KSK, Method: DoubleRRSet.

State Current key state

Type Key type

Tag Key tag/ID

CreateTimeStr Key creation time

ActivationTimeStr Key activation time

ExpiryTimeStr Key expiry time

DeletionTimeStr Key deletion time if autorollover option is enabled

RolloverFailRC Reason code in case rollover event failed

revoke Revoke the key. Note: This operation is non-reversible.

devno count stateflag

Example

show dns key

unset dns key

Use this command to remove dns key settings.Refer to the set dns key command for meanings of the arguments.

Synopsis

unset dns key [-expires] [-units] [-notificationPeriod] [-units] [-TTL] [-autoRollover] [-RolloverMethod]

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

dns-key

May 28, 2024

Contributed by:

May 28, 2024

Contributed by:

dns-key

set dns key

Synopsis

Arguments

Example

import dns key

Synopsis

Arguments

add dns key

Synopsis

Arguments

Example

rm dns key

Synopsis

Arguments

Example

create dns key

Arguments

Example

show dns key

Synopsis

Arguments

Output

Example

unset dns key

Synopsis

In this article