Generate new KSK and ZSK | Utimaco Integration Guides

Generate a new key pair as ksk1 and zks1 on HSM as shown below. Here the KSK key label used is ksk1 and ZSK key label is zsk1.

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 0 --login --keypairgen --key-type RSA:2048 --label ksk1 --id 03

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 0 --login --keypairgen --key-type RSA:2048 --label zsk1 --id 04

11_11.1.1_new_ksk_key_generation-20260708-070201.png

New KSK generated

11_11.1.2_new_zsk_key_generation-20260708-070253.png

New ZSK generated

Verify the generated keys in HSM.

p11tool2 slot=0 LoginUser=ask ListObjects

11_11.2_new_key_verification-20260708-070311.png

Keys updated in HSM