Breadcrumbs

For ECC Keys

  1. Create a new directory ECC_keyfiles/ for keeping ECC reference key files.

  2. Make sure exampleecc.net exists. If not, create similarly to example.net.

  3. Generate the key file for KSK.

›_ Console 

/usr/local/bin/dnssec-keyfromlabel -f KSK -a ECDSAP256SHA256 -l "pkcs11:token=Bind9_EC;object=ksk" exampleecc.net

Where the parameter:

  • -l specifies the key label in pkcs11 URI format.

  • -f specifies the key flag.

  • -a is the algorithm.

  • exampleecc.net is the name of zone file.

08_8.2.1_ECC_ksk_ref_key_file-20260706-225453.png


Key file generation for the KSK key

  1. Generate the key file for ZSK.

›_ Console 

/usr/local/bin/dnssec-keyfromlabel -a ECDSAP256SHA256 -l "pkcs11:token=Bind9_EC;object=zsk" exampleecc.net
08_8.2.2_ECC_zsk_ref_key_file-20260706-225745.png


Key file generation for the ZSK key

Where the parameter:

  • -l specifies the key label in pkcs11 URI format.

  • -f specifies the key flag.

  • -a is the algorithm.

  • exampleecc.net is the name of zone file.

  1. Verify that you have two KSK and two ZSK key files available.

›_ Console 

# ls -lh
image-20260706-230115.png


List files


The .private file contains a reference to the HSM object, not the private key itself.