Breadcrumbs

Generate ZSK and KSK on Utimaco HSM

To generate a zone-signing key (ZSK) and a key-signing key (KSK) on the HSM use the pkcs11-tool utility. After the keys are generated on HSM, use dnssec-keyfromlabel provided by BIND to generate the key files for BIND containing a public key and an identifier of the actual private key.

Two slots need to be initialized in HSM for RSA and ECC keys. The slot labels should be unique. For this integration, slot labels are 'Bind9_RSA' and 'Bind9_EC'.

Generating KSK and ZSK with RSA Algorithm

  1. Run the following commands to generate a zone-signing key and a key-signing key using RSA algorithm:

›_ Console 

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 0 --login --keypairgen --key-type RSA:2048 --label ksk --id 01

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 0 --login --keypairgen --key-type RSA:2048 --label zsk --id 02
07_7.1.1_RSA_ksk_keypair_creation-20260703-122146.png


Key generation output for KSK -RSA

07_7.1.2_RSA_zsk_keypair_creation-20260703-122146.png


Key generation output for ZSK -RSA

Each key should have a unique label that will be used to refer to the private key in the next steps.

  1. List the keys using the p11tool2 command.

›_ Console 

p11tool2 slot=0 LoginUser=ask ListObjects
07_7.1.3_RSA_key_verification-20260703-122146.png


List key output in slot 0

Generating KSK and ZSK with ECC algorithm

  1. Run the following commands to generate a zone-signing key and a key-signing key using ECC. Curve used is prime256v1.

›_ Console 

pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 1 --login --keypairgen --key-type EC:prime256v1 --label ksk --id 01
pkcs11-tool --module /opt/utimaco/lib/libcs_pkcs11_R3.so --slot 1 --login --keypairgen --key-type EC:prime256v1 --label zsk --id 02
8395cd02-1348-43f7-88cd-8c7a7c1396a6.png


Key generation output for KSK -ECC


07_7.2.2_ECC_zsk_keypair_creation-20260703-122146.png

Key generation output for ZSK-ECC

Each key should have a unique label that will be used to refer to the private key in the next steps.

  1. List the keys using the p11tool2 command.

›_ Console 

# p11tool2 slot=1 LoginUser=ask ListObjects
07_7.2.3_ECC_key_verification-20260703-122146.png


List key output in slot 1