dnssec-cds — change DS records for a child zone based on CDS/CDNSKEY
dnssec-cds
[-a ...]
[alg-c ]
[class-D]
{-d }
{dsset-file-f }
[child-file-i [extension]]
[-s ]
[start-time-T ]
[ttl-u]
[-v ]
[level-V]
{domain}
The dnssec-cds command changes DS records at a delegation point based on CDS or CDNSKEY records published in the child zone. If both CDS and CDNSKEY records are present in the child zone, the CDS is preferred. This enables a child zone to inform its parent of upcoming changes to its key-signing keys; by polling periodically with dnssec-cds, the parent can keep the DS records up to date and enable automatic rolling of KSKs.
Two input files are required. The
-f
option specifies a file containing the child's CDS and/or CDNSKEY
records, plus RRSIG and DNSKEY records so that they can be
authenticated. The
child-file-d
option specifies the location of a file containing the current DS
records. For example, this could be a pathdsset-
file generated by dnssec-signzone, or the output of
dnssec-dsfromkey, or the output of a previous
run of dnssec-cds.
The dnssec-cds command uses special DNSSEC validation logic specified by RFC 7344. It requires that the CDS and/or CDNSKEY records are validly signed by a key represented in the existing DS records. This will typicially be the pre-existing key-signing key (KSK).
For protection against replay attacks, the signatures on the
child records must not be older than they were on a previous run
of dnssec-cds. This time is obtained from the
modification time of the dsset- file, or
from the -s option.
To protect against breaking the delegation, dnssec-cds ensures that the DNSKEY RRset can be verified by every key algorithm in the new DS RRset, and that the same set of keys are covered by every DS digest type.
By default, replacement DS records are written to the standard
output; with the -i option the input file is
overwritten in place. The replacement DS records will be the
same as the existing records when no change is required. The
output can be empty if the CDS / CDNSKEY records specify that
the child zone wants to go insecure.
Warning: Be careful not to delete the DS records when dnssec-cds fails!
Alternatively, dnssec-cds -u writes
an nsupdate script to the standard output.
You can use the -u and -i
options together to maintain a dsset- file
as well as emit an nsupdate script.
algorithmSpecify a digest algorithm to use when converting CDNSKEY records to DS records. This option can be repeated, so that multiple DS records are created for each CDNSKEY record. This option has no effect when using CDS records.
The algorithm must be one of SHA-1
(SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
values are case insensitive. If no algorithm is specified,
the default is SHA-256.
classSpecifies the DNS class of the zones.
Generate DS records from CDNSKEY records if both CDS and CDNSKEY records are present in the child zone. By default CDS records are preferred.
path
Location of the parent DS records.
The path can be the name of a file
containing the DS records, or if it is a
directory, dnssec-cds looks for
a dsset- file for
the domain inside the directory.
To protect against replay attacks, child records are
rejected if they were signed earlier than the modification
time of the dsset- file. This can be
adjusted with the -s option.
child-fileFile containing the child's CDS and/or CDNSKEY records, plus its DNSKEY records and the covering RRSIG records so that they can be authenticated.
The EXAMPLES below describe how to generate this file.
extension]
Update the dsset- file in place,
instead of writing DS records to the standard output.
There must be no space between the -i and
the extension. If you provide
no extension then the
old dsset- is discarded. If
an extension is present, a
backup of the old dsset- file is kept
with the extension appended to
its filename.
To protect against replay attacks, the modification time
of the dsset- file is set to match