Breadcrumbs

For RSA Keys

  1. Create a new directory RSA_keyfiles/ for keeping RSA reference keys files.

  2. Generate the key file for KSK.

›_ Console 

/usr/local/bin/dnssec-keyfromlabel -f KSK -a RSASHA256 -l "pkcs11:token=Bind9_RSA;object=ksk" example.net

Where the parameter:

  • -l specifies the key label in pkcs11 URI format.

  • -f specifies the key flag.

  • -a is the algorithm.

  • example.net is the name of zone file.

08_8.1.1_RSA_ksk_ref_key_file-20260703-122146.png


Key file generation for KSK key

  1. Generate the key file for ZSK.

›_ Console 

/usr/local/bin/dnssec-keyfromlabel -a RSASHA256 -l "pkcs11:token=Bind9_RSA;object=zsk" example.net
08_8.1.2_RSA_zsk_ref_key_file-20260703-122146.png


Key file generation for the ZSK Key

Where the parameter:

  • -l specifies the key label in pkcs11 URI format.

  • -a is the algorithm.

  • example.net is the name of zone file.

  1. Verify that you have two KSK and two ZSK key files available.

›_ Console 

# ls -lh
image-20260706-223522.png


List files