<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2">
<div>-----BEGIN PGP SIGNED MESSAGE-----</div>
<div>Hash: SHA256</div>
<div> </div>
<div>> > makes me wonder how I decide what the label, id and pin should be for</div>
<div>> the key I import. Further down that page I see</div>
<div> </div>
<div>Label is a string which describes the object. Not used by OpenDNSSEC.</div>
<div>ID is the id of the key that you want to create. Hexadecimal. Used by OpenDNSSEC.</div>
<div>PIN is the PIN code that you use to login to the token.</div>
<div> </div>
<div>> > ods-ksmutil key import --cka_id <CKA_ID> --repository <repository> -</div>
<div>> -zone <zone> --bits <size> --algorithm <algorithm> --keystate <state> -</div>
<div>> -keytype <type> --time <time></div>
<div>> ></div>
<div>> > and I find I don't know</div>
<div>> ></div>
<div>> > (a) what a CKA_ID is</div>
<div> </div>
<div>It is the hexadecimal string from the previous step.</div>
<div> </div>
<div>> > (b) the difference between active and ready for the key state</div>
<div> </div>
<div>Keystate active will make the key active. It is used for signing directly. If there already is an active key, then there will be two keys signing the zone. So if you only want this key to sign the zone, then do the import directly after setup and before
you start the system.</div>
<div> </div>
<div>Keystate ready will add the key in the ready queue. Will become active in a future rollover, if the key matches the policy.</div>
<div> </div>
<div>> > This whole procedure seems like it would be usefully automated even</div>
<div>> if just for the case here people are using softhsm with something like</div>
<div>> ></div>
<div>> > ./bind9-to-softhsm ./Kexample.com.+005+42952.private EXAMPLE.COM</div>
<div>> ></div>
<div>> > and have the script figure out all the heavy lifting. But I am not</div>
<div>> asking for a script :-) just some guidance on the questions above. Any</div>
<div>> clues for me?</div>
<div> </div>
<div>I will update the documentation.</div>
<div> </div>
<div>We could have a script, but you would still need label, ID, slot, and PIN. Label and ID could be a random string.</div>
<div> </div>
<div>-----BEGIN PGP SIGNATURE-----</div>
<div>Version: 9.8.3 (Build 4028)</div>
<div>Charset: utf-8</div>
<div> </div>
<div>wsBVAwUBSx4pZ+CjgaNTdVjaAQik8gf8DaZ5sdgXN1AHoTrr5PmvYZteX8JRCkYV</div>
<div>tGsSUZQ67FhmB6INZSlMrjpYTmitmnj6mDOH5JDRL/bexx2R0uHOzTK0BSnMPcTl</div>
<div>1Z67M8MSCBnYls0Fd/caQ3jE+qmScPShYRaeZe6nyVSaiv0Be7XIUzEpmJrMWZef</div>
<div>PRJr6/6PcSkc2QMGJQ0DCFsFg9oGmZ351DXmDWau7DsELsMQXjM/+VfIGIOiL2rw</div>
<div>pTVnJBdj8gxtfe2oJPnPW3VwVsYZKE/RgkbbxiNVxLJk0uKpK1RZcsPtLoFTg2eS</div>
<div>cmdo7pRhCp/Z5qKoL4L3IThXKFBYb9QtJum+3FTlbM9u13kOfp/4pA==</div>
<div>=iIUI</div>
<div>-----END PGP SIGNATURE-----</div>
<div> </div>
<div> </div>
</font>
</body>
</html>