generate-zsk

#!/bin/bash

# Copyright 2014-2015 Richard Russon (FlatCap)
# Licensed under the GPLv3

PATH="/var/named/bin:/usr/bin:/usr/sbin"
source log.sh

export TZ="UTC"

set -o errexit	# set -e
set -o nounset	# set -u

renice --priority 19 --pid $$ > /dev/null
ionice --class 3     --pid $$ > /dev/null

shopt -s nullglob

function finish()
{
	local RETVAL=$?
	[ $RETVAL = 0 ] || log_error "${0##*/} failed: $RETVAL"
}

trap finish EXIT

cd /var/named

log_info "Generate Zone-Signing Key"

if [ ! $# = 1 -a ! $# = 3 ]; then
	echo "Usage: ${0##*/} ZONE [YEAR MONTH]"
	exit 2
fi

ZONE="$1"
YEAR="${2:-$(date '+%Y')}"
MONTH="${3:-$(date '+%m')}"
DAY="01"
TIME="040000"
VALID="1 month + 2 days"

P="$(date "+%Y%m%d" --date "$YEAR-$MONTH-$DAY - 2 days")$TIME"
A="$(date "+%Y%m%d" --date "$YEAR-$MONTH-$DAY")$TIME"
I="$(date "+%Y%m%d" --date "$YEAR-$MONTH-$DAY + $VALID")$TIME"
D="$(date "+%Y%m%d" --date "$YEAR-$MONTH-$DAY + $VALID + 2 days")$TIME"

# echo P=$P
# echo A=$A
# echo I=$I
# echo D=$D
# exit

mkdir --parents "$DNSSEC_KEY_DIR"

dnssec-keygen -a RSASHA256 -n ZONE -K "$DNSSEC_KEY_DIR" -b 2048 -P $P -A $A -I $I -D $D $ZONE

exit 0