Sign and Verify the Zone File

During zone signing you need to provide the name of the OpenSSL engine using the -E command line option.

Sign and Verify Zone Files with RSA Keys

1. Use dnssec-signzone command to perform zone signing.

# dnssec-signzone -E pkcs11 -S -o example.net /var/named/example.net 

Zone signing for RSA key

This generates the example.net.signed file.

2. Verify the signed zone file.

# dnssec-verify -E pkcs11 -z -o example.net /var/named/example.net.signed 

Kexample.net.+008+06500.key Kexample.net.+008+44509.key 

Zone verification for RSA key

Where Kexample.net.+008+06500.key is key file generated for ksk key and Kexample.net.+008+44509.key is key file generated for zsk key.

Sign and Verify Zone Files with ECC Keys

1. Use dnssec-signzone command below to perform zone signing.

# dnssec-signzone -E pkcs11 -S -o exampleecc.net /var/named/exampleecc.net 

Zone signing for ECC key

This generates the exampleecc.net.signed file.

2. Verify the signed zone file.

# dnssec-verify -E pkcs11 -o exampleecc.net /var/named/exampleecc.net.signed  

Zone verification for ECC key