Appendix B: Command Summary

mkdir -p /opt/utimaco/bin

Create the Utimaco binary directory.

mkdir -p /opt/utimaco/lib

Create the Utimaco library directory.

cp ~/path_to_application_folder/lib/libcs_pkcs11_R3.so /opt/utimaco/lib

Copy the Utimaco PKCS#11 library to the target location.

cd ~/path_to_application_folder

Change to the SecurityServer installation directory.

cp csadm p11tool2 /opt/utimaco/bin

Copy Utimaco administration utilities.

chmod +x /opt/utimaco/bin/csadm /opt/utimaco/bin/p11tool2

Make the utilities executable.

cd <install_directory>/Software/Linux/x86-64/Crypto_APIs/PKCS11_R3/sample

Navigate to the PKCS#11 sample configuration directory.

cp cs_pkcs11_R3.cfg /home/admin/Bind9

Copy the PKCS#11 configuration file.

cd /home/admin/Bind9

Change to the Bind9 working directory.

export CS_PKCS11_R3_CFG=/home/admin/Bind9/cs_pkcs11_R3.cfg

Set the PKCS#11 configuration environment variable.

p11tool2 slot=<slot_no> Label=<token_label> Login=ADMIN,ADMIN.key InitToken=ask

Create and initialize an HSM token/slot.

p11tool2 slot=<slot_no> LoginSO=ask InitPin=ask

Initialize the Security Officer PIN.

openssl version -a

Verify the installed OpenSSL version.

openssl list -providers

Verify the installed OpenSSL providers, including PKCS#11 provider.

tar -xvf bind9-9.20.23.tar.gz

Extract the Bind9 source package.

autoreconf -fi

Generate the configure scripts for Bind9 build.

dnf install openssl-devel perl libicu-devel pkgconf userspace-rcu-devel libcap-devel libuv-devel

Install Bind9 build dependencies.

configure CC="gcc -m64" -enable-threads -disable-doh

Configure the Bind9 build environment.

make

Build Bind9 from source.

make install

Install the compiled Bind9 software.

/usr/local/sbin/named -version

Check the installed Bind9 version.

/usr/local/sbin/named -f -c /usr/local/etc/named.conf

Start the Bind9 DNS service.

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 0 --login --keypairgen --key-type RSA:2048 --label ksk --id 01

Generate an RSA KSK on the HSM.

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 0 --login --keypairgen --key-type RSA:2048 --label zsk --id 02

Generate an RSA ZSK on the HSM.

p11tool2 slot=0 LoginUser=ask ListObjects

List objects stored in RSA slot.

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 1 --login --keypairgen --key-type EC:prime256v1 --label ksk --id 01

Generate an ECC KSK on the HSM.

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 1 --login --keypairgen --key-type EC:prime256v1 --label zsk --id 02

Generate an ECC ZSK on the HSM.

p11tool2 slot=1 LoginUser=ask ListObjects

List objects stored in ECC slot.

/usr/local/bin/dnssec-keyfromlabel -f KSK -a RSASHA256 -l "pkcs11:token=Bind9_RSA;object=ksk" example.net

Generate a Bind9 reference key file for RSA KSK.

/usr/local/bin/dnssec-keyfromlabel -a RSASHA256 -l "pkcs11:token=Bind9_RSA;object=zsk" example.net

Generate a Bind9 reference key file for RSA ZSK.

ls -lh

List generated key files.

/usr/local/bin/dnssec-keyfromlabel -f KSK -a ECDSAP256SHA256 -l "pkcs11:token=Bind9_EC;object=ksk" exampleecc.net

Generate a Bind9 reference key file for ECC KSK.

/usr/local/bin/dnssec-keyfromlabel -a ECDSAP256SHA256 -l "pkcs11:token=Bind9_EC;object=zsk" exampleecc.net

Generate a Bind9 reference key file for ECC ZSK.

/usr/local/bin/dnssec-signzone -S -o example.net /var/named/example.net

Sign a DNS zone using RSA keys.

/usr/local/bin/dnssec-verify -z -o example.net /var/named/example.net.signed Kexample.net.+008+44141.key Kexample.net.+008+22449.key

Verify a signed RSA zone file.

/usr/local/bin/dnssec-signzone -S -z -o exampleecc.net /var/named/exampleecc.net

Sign a DNS zone using ECC keys.

/usr/local/bin/dnssec-verify -z -o exampleecc.net /var/named/exampleecc.net.signed Kexampleecc.net.+013+15983.key Kexampleecc.net.+013+23348.key

Verify a signed ECC zone file.

vi /usr/local/etc/named.conf

Edit the Bind9 configuration file.

/usr/local/sbin/named -f -4 -g -c /usr/local/etc/named.conf

Start Bind9 with DNSSEC-enabled configuration.

/usr/local/bin/dnssec-verify -z -o example.net /var/named/example.net.signed

Verify the re-signed DNS zone after key rollover.