Usage: DnsCmd /OfflineSign /GenKey /Alg /Flags /Length /Zone /SSCert /FriendlyName /ValidFrom /ValidTo - the key algorithm ...

Usage: 
 DnsCmd /OfflineSign /GenKey /Alg  [/Flags ]
 /Length  /Zone  /SSCert [/FriendlyName ]
 [/ValidFrom ] [/ValidTo ]

          -- the key algorithm mnemonic string. Currently only
                     "RSASHA1" is supported.
        -- bits to be set to 1 in DNSKEY flags field. If 
                     is "KSK",  the Secure Entry Point bit will be set to 1
                     to indicate that this key is a Key Signing Key. If no
                     /Flags is given, the key is considered to be a Zone 
                     Signing Key.
       -- length of the key in bits. For RSASHA1 algorithm, the
                     key length can start from 512 bits in 64 bit increment
                     up to 4096 bits.
        -- name of the zone that the key is intended for
    -- friendly name for the certificate
       -- the starting time of the valid period of the
                     certificate in YYYYMMDDHHMMSS (4-digit year, 2-digit
                     month, 2-digit day, 2-digit hour, 2-digit minute, and
                     2-digit second). The time is UTC. If
                     /ValidFrom is not given, the validity period will start
                     one hour before the current time.
         -- the end time of the valid period of the certificate.
                     Its format is the same as . If /ValidTo
                     is not given, the validity period will end in 5 years
                     from .