我正在配置 BIND9 以獲取通配符證書讓我們加密。當我嘗試根據以下內容產生 TSIG 金鑰時此處說明,我收到以下錯誤:
# dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST keyname.
dnssec-keygen: fatal: unknown algorithm HMAC-SHA512
然後我閱讀幫助並文件關於dnssec-keygen
,沒有稱為的演算法HMAC-SHA512的確:
# dnssec-keygen -h
Usage:
dnssec-keygen [options] name
Version: 9.14.2
name: owner of the key
Options:
-K <directory>: write keys into directory
-a <algorithm>:
RSASHA1 | NSEC3RSASHA1 |
RSASHA256 | RSASHA512 |
ECDSAP256SHA256 | ECDSAP384SHA384 |
ED25519 | ED448 | DH
-3: use NSEC3-capable algorithm
-b <key size in bits>:
RSASHA1: [1024..4096]
NSEC3RSASHA1: [1024..4096]
RSASHA256: [1024..4096]
RSASHA512: [1024..4096]
DH: [128..4096]
ECDSAP256SHA256: ignored
ECDSAP384SHA384: ignored
ED25519: ignored
ED448: ignored
(key size defaults are set according to
algorithm and usage (ZSK or KSK)
-n <nametype>: ZONE | HOST | ENTITY | USER | OTHER
(DNSKEY generation defaults to ZONE)
-c <class>: (default: IN)
-d <digest bits> (0 => max, default)
-E <engine>:
name of an OpenSSL engine to use
-f <keyflag>: KSK | REVOKE
-g <generator>: use specified generator (DH only)
-L <ttl>: default key TTL
-p <protocol>: (default: 3 [dnssec])
-s <strength>: strength value this key signs DNS records with (default: 0)
-T <rrtype>: DNSKEY | KEY (default: DNSKEY; use KEY for SIG(0))
-t <type>: AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF (default: AUTHCONF)
-h: print usage and exit
-m <memory debugging mode>:
usage | trace | record | size | mctx
-v <level>: set verbosity level (0 - 10)
-V: print version information
Timing options:
-P date/[+-]offset/none: set key publication date (default: now)
-P sync date/[+-]offset/none: set CDS and CDNSKEY publication date
-A date/[+-]offset/none: set key activation date (default: now)
-R date/[+-]offset/none: set key revocation date
-I date/[+-]offset/none: set key inactivation date
-D date/[+-]offset/none: set key deletion date
-D sync date/[+-]offset/none: set CDS and CDNSKEY deletion date
-G: generate key only; do not set -P or -A
-C: generate a backward-compatible key, omitting all dates
-S <key>: generate a successor to an existing key
-i <interval>: prepublication interval for successor key (default: 30 days)
Output:
K<name>+<alg>+<id>.key, K<name>+<alg>+<id>.private
我深入研究另一個問題:無法透過 dnssec-keygen 產生金鑰,但我的問題仍然沒有解決。
我該怎麼辦?
答案1
經過一番搜索,我發現插件的文檔certbot-dns-rfc2136
是過時的!
在BIND9的官方git儲存庫中,我發現了以下內容提交訊息:
- [func] 不建議使用 dnssec-keygen 產生 HMAC 金鑰,改用 tsig-keygen。用於此目的時,dnssec-keygen 將列印警告。在未來版本中,所有 HMAC 演算法都將從 dnssec-keygen 中刪除。 [RT#42272]
所以,最終的解決方案是:
tsig-keygen -a hmac-sha512 tsig-key > /etc/bind/tsig.key