Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a tool which allows me to view the parameters of an existing private/public key used for DNSSEC in Bind 9?

I've been unable to determine simple things such as the expiration date, the algorithm, key strength, zone name for key, etc.

share|improve this question

Your question could mean two things. Are you wanting to check the parameters for a remote server, or one which you have the private and public key files for?

Also note, DNSSEC keys don't actually have expiration dates. Signatures do. The expiration date of a key is a concept that many DNS server implementations have created, and is part of their key management system.

Signature expiration times are easy to read from the output of dig +dnssec, as they are in YYYYMMDDhhmmss format. Extracting the key algorithm and length from the dnskey record is a bit harder using dig as it does not convert "5" to "RSASHA1" for instance.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.