Usage: DnsCmd /OfflineSign /GenKey /Alg /Flags /Length /Zone /SSCert /FriendlyName /ValidFrom /ValidTo - the key algorithm ...

Usage: 
 DnsCmd /OfflineSign /GenKey /Alg  [/Flags ]
 /Length  /Zone  /SSCert [/FriendlyName ]
 [/ValidFrom ] [/ValidTo ]

          -- the key algorithm mnemonic string. Currently only
                     "RSASHA1", "NSEC3RSASHA1", "RSASHA256",
                     "RSASHA512", "ECDSAP256SHA256"
                     and "ECDSAP384SHA384" are supported.
        -- bits to be set to 1 in DNSKEY flags field. If 
                     is "KSK",  the Secure Entry Point bit will be set to 1
                     to indicate that this key is a Key Signing Key. If no
                     /Flags is given, the key is considered to be a Zone
                     Signing Key.
       -- length of the key in bits. For RSA algorithms the value
                     can range from 1024 bits in 64 bit increments up to 4096 
                     bits. Key size is ignored for other algorithms.
        -- name of the zone that the key is intended for
    -- friendly name for the certificate
       -- the starting time of the valid period of the
                     certificate in YYYYMMDDHHMMSS (4-digit year, 2-digit
                     month, 2-digit day, 2-digit hour, 2-digit minute, and
                     2-digit second). The time is UTC. If
                     /ValidFrom is not given, the validity period will start
                     one hour before the current time.
         -- the end time of the valid period of the certificate.
                     Its format is the same as . If /ValidTo
                     is not given, the validity period will end in 5 years
                     from .