KEYCONV(8)

NAME
keyconv - DNSSEC/OpenSSL private key converter

SYNOPSIS
keyconv -do infile outfile

DESCRIPTION
The keyconv utility converts between the key formats used by OpenSSL, as produced by openssl(1), and DNSSEC, as produced by dnssec-keygen(8). The primary use of keyconv is to generate the DNS "KEY" resource records that, when signed, can be used by isakmpd(8) to authenticate an IKE negotiation.

For proper operation, infile is expected to contain the private key.

The mode of operation is determined as follows:

-d  Convert from DNSSEC to OpenSSL format.

-o  Convert from OpenSSL to DNSSEC format. In this mode, keyconv outputs both the private key, plus a outfile.pubkey file containing the public key in DNS KEY format.

The dnssec-keygen command is supplied as part of BIND version 8 and 9 and can currently be found in the OpenBSD ports collection.

EXAMPLES
Create a new RSA key for usage both in isakmpd(8) and DNSSEC.

    $ openssl genrsa -out testkey.ssl 1024
    $ keyconv -d testkey.ssl testkey.dns

SEE ALSO
openssl(1), isakmpd(8)

HISTORY
This command first appeared in OpenBSD 3.0.