DnssecKeyService
class DnssecKeyService (View source)
Lists, adds, activates, deactivates and removes the DNSSEC keys of a zone the one way the web key pages and the API agree on: validate a new key against what the server offers, refuse changes when PowerDNS cannot be asked, has DNSSEC off or the zone is presigned, and audit what changed.
Constants
| private MAX_PRIVATE_KEY_BYTES |
Generous upper bound for an ISC private key; an RSA-4096 key is about 3.3 KB |
Methods
No description
No description
No description
Check a new key's type, algorithm and size, in that order, without asking PowerDNS.
No description
Check that a private key looks like the ISC/BIND format PowerDNS imports ("Private-key-format: v1.x" and an "Algorithm:" line), without asking PowerDNS. PEM keys are refused: the PowerDNS HTTP API does not take them.
Import a key from an existing ISC/BIND private key. PowerDNS derives the algorithm and size from the key; the created key carries them. The key's algorithm must be one offered for new keys.
No description
Activate an inactive key or deactivate an active one; the result's key tells which.
No description
Details
__construct(ZoneKeyManagementInterface&ZoneSigningInterface $dnssec, AuditLoggerInterface $audit)
No description
DnssecKeyResult
listKeys(string $zoneName)
No description
DnssecKeyResult
findKey(string $zoneName, int $keyId)
No description
DnssecKeyResult|null
validateNewKey(string $type, string $algorithm, int|null $bits, PdnsCapabilities|null $capabilities)
Check a new key's type, algorithm and size, in that order, without asking PowerDNS.
DnssecKeyResult
addKey(int $zoneId, string $zoneName, string $type, string $algorithm, int $bits, bool $active, PdnsCapabilities|null $capabilities)
No description
static bool
isIscPrivateKey(string $privateKey)
Check that a private key looks like the ISC/BIND format PowerDNS imports ("Private-key-format: v1.x" and an "Algorithm:" line), without asking PowerDNS. PEM keys are refused: the PowerDNS HTTP API does not take them.
DnssecKeyResult
importKey(int $zoneId, string $zoneName, string $type, string $privateKey, bool $active, PdnsCapabilities|null $capabilities = null)
Import a key from an existing ISC/BIND private key. PowerDNS derives the algorithm and size from the key; the created key carries them. The key's algorithm must be one offered for new keys.
The private key is only passed on to PowerDNS: it is not audited, logged or part of the result.
DnssecKeyResult
setKeyActive(int $zoneId, string $zoneName, int $keyId, bool $active)
No description
DnssecKeyResult
toggleKey(int $zoneId, string $zoneName, int $keyId)
Activate an inactive key or deactivate an active one; the result's key tells which.
DnssecKeyResult
removeKey(int $zoneId, string $zoneName, int $keyId)
No description