Intent to remove native PKCS#11 from BIND 9.18+

Ondřej Surý ondrej at
Fri May 7 14:12:34 UTC 2021

Hey everybody,

this topic is even more obscure than Windows.

Currently, BIND 9 has two PKCS#11 interfaces:

* native PKCS#11 that uses direct PKCS#11 API calls to library that dynamically loaded (from compiled-in path)
* OpenSSL engine PKCS#11 from OpenSC project[1]

ISC has sponsored significant improvements to the OpenSC engine_pkcs11 and the next OpenSC version will include those improvements. The new version has better performance and is maintained by people who actually understand the PKCS#11 interface. Those improvements will be part of libp11 0.4.12 release.

Therefore we intent to drop the native PKCS#11 interface from BIND 9.18, so there’s less arcane code in named and we can focus on the DNS.


Ondřej Surý (He/Him)
ondrej at

More information about the bind-users mailing list