<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello,<br>
<br>
I have BIND 9.10 compiled with native PKCS#11 support and Thales
nShield Connect HSM.<br>
The problem is with dnssec-keyfromlabel that is unable to generate
key pair from HSM.<br>
First, the keys were generated in HSM using OpenDNSSEC.<br>
<br>
The keys are correctly listed by following command:<br>
$ sudo /usr/local/bind9.10.2/sbin/pkcs11-list -s 761406613<br>
slot 761406613<br>
Enter Pin: <br>
object[0]: handle 1122 class 3 label[32]
'9af889382e25222b32eb59f67c95cb53' id[16] 0x9af889382e25222b...<br>
object[1]: handle 1123 class 3 label[32]
'1095a767cb4e3ac8f5cdcb8d4a108e34' id[16] 0x1095a767cb4e3ac8...<br>
<br>
When trying to execute the following command i get the error:<br>
$ sudo /usr/local/bind9.10.2/sbin/dnssec-keyfromlabel -l
"pkcs11:object=9af889382e25222b32eb59f67c95cb53;pin-source=/etc/pass"
-a 8 -P now -A now <a href="http://example.com">example.com</a><br>
dnssec-keyfromlabel: fatal: failed to get key <a
href="http://example.com/RSASHA256">example.com/RSASHA256</a>: not
found<br>
<br>
Any ideas on how to solve this ?<br>
<br>
<br>
Regards,<br>
<br>
Catalin L.<br>
</body>
</html>