<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=GB2312" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: ËÎÌå; COLOR: #000080; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>
<DIV>Hi Jakob,</DIV>
<DIV> </DIV>
<DIV>Thanks for your information.</DIV>
<DIV> </DIV>
<DIV>>You should be able to create the key on the HSM and then import it into OpenDNSSEC</DIV>
<DIV>I can generate keys using pkcs11-tool command with SoftHSM moduel,but I
don't think we can get</DIV>
<DIV>keys out of HSM to import into OpenDNSSEC by using 'ods-ksmutil key
import', because private</DIV>
<DIV>key can not be exported,right?</DIV>
<DIV> </DIV>
<DIV>
<DIV>>If the key does not have a label, you might be able to set one using pkcs11-tool (from the OpenSC package).</DIV>
<DIV>Yes, we can generate key and specify a label for it, but I don't think
pkcs11-tool can generate keys directly,</DIV>
<DIV>because the key generation must be done manually with admin
privilege.</DIV>
<DIV> </DIV>
<DIV>Even if I could set a label with pkcs11-tool, can OpenDNSSC support
<KeyLabel>? I think the key rollover </DIV>
<DIV>should be done manually and the conf.xml should support more
<KeyLabel> then.</DIV>
<DIV> </DIV>
<DIV>If the key generation must be done manually, the key rollover can not be
done by OpenDNSSEC automatically,</DIV>
<DIV>it have to be done manually, too.</DIV></DIV>
<DIV> </DIV></DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV>
<DIV> </DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0cm; PADDING-LEFT: 0cm; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<DIV
style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; COLOR: #000000; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV><B>From:</B> <A href="mailto:jakob@kirei.se">Jakob Schlyter</A></DIV>
<DIV><B>Date:</B> 2012-10-09 17:08</DIV>
<DIV><B>To:</B> <A href="mailto:shuoleo@126.com">shuoleo</A></DIV>
<DIV><B>CC:</B> <A
href="mailto:opendnssec-user@lists.opendnssec.org">opendnssec-user</A>; <A
href="mailto:pawal@opendnssec.org">Patrik Wallström</A></DIV>
<DIV><B>Subject:</B> Re: [Opendnssec-user]</DIV></DIV></DIV>
<DIV>
<DIV>You should be able to create the key on the HSM and then import it into OpenDNSSEC, given that a proper KeyLabel exists. If the key does not have a label, you might be able to set one using pkcs11-tool (from the OpenSC package).</DIV>
<DIV> </DIV>
<DIV>jakob</DIV>
<DIV> </DIV></DIV></BODY></HTML>