Testing Key Generation onto the Utimaco HSM using OpenDNSSEC

1. Run the below command to generate the keys using the ods-hsmutil utility onto Utimaco HSM.

# ods-hsmutil generate utimaco rsa 2048         

Generate RSA key output

2. Using p11tool2 utility, verify the keys are created on the HSM using the below command.

# p11tool2 slot=9 loginuser=123456 listobjects 

ListObjects output

3. List the contents of OpenDNSSEC Repository and verify the keys created is listed below with the command below.

# ods-hsmutil list utimaco 

List DNSSEC keys output

4. Test the HSM by generating a DNSKEY Resource Record using the previously created RSA key.

# ods-hsmutil dnskey  dd68f48d0f2f67c5cd6b3d8f6e01b93a  utimaco 256 5 

Generate resource record DNSKEY output

5. (Optional) If the user wants to delete the key from the local repository, use the command below.

# ods-hsmutil remove dd68f48d0f2f67c5cd6b3d8f6e01b93a 

Delete DNSSEC key output

6. (Optional) Now, as the communication between the Utimaco HSM and OpenDNSSEC is established and verified, you can run a few built-in tests as shown below.

# ods-hsmutil test utimaco 

DNSSEC built-in test output

DNSSEC built-in test output