Skip to main content
softhsm2-keyconv converts BIND .private-key files to PKCS#8 PEM format so they can be imported into SoftHSM (or any PKCS#11 token) using softhsm2-util.
For other input formats, use openssl to convert to PKCS#8 first, then import with softhsm2-util.
softhsm2-keyconv --in path --out path [--pin PIN]

​
Options

​
--in path
string
required
Path to the input file. The file must be in BIND .private-key format (e.g., Kexample.com.+007+05474.private).
​
--out path
string
required
Path to the output file. The converted key is written in PKCS#8 PEM format.
​
--pin PIN
string
A PIN used to encrypt the output PKCS#8 file. If not provided, the output file is written unencrypted.
​
--help, -h
flag
Show the help screen.
​
--version, -v
flag
Show version info.

​
Examples

​
Convert a BIND key to PKCS#8

softhsm2-keyconv --in Kexample.com.+007+05474.private \
  --out rsa.pem

​
Convert and encrypt the output

Pass --pin to protect the output file with a PIN. You will then need to supply the same PIN via --file-pin when importing with softhsm2-util: 
softhsm2-keyconv --in Kexample.com.+007+05474.private \
  --out rsa.pem --pin secretpassword

​
BIND-to-SoftHSM workflow

1

Generate or locate your BIND key

BIND keys are typically generated by dnssec-keygen and have filenames like Kexample.com.+007+05474.private.
2

Convert to PKCS#8

softhsm2-keyconv --in Kexample.com.+007+05474.private \
  --out rsa.pem
3

Initialize a SoftHSM token

softhsm2-util --init-token --free --label "mytoken" \
  --so-pin 1234 --pin 5678
4

Import the PKCS#8 key into the token

softhsm2-util --import rsa.pem --token "mytoken" \
  --label "My BIND key" --id A1B2 --pin 5678
If you encrypted the output in step 2, add --file-pin secretpassword.

​
See also

  • softhsm2-util — import keys and manage tokens
  • softhsm2-migrate — migrate SoftHSM v1 databases
  • softhsm2.conf(5) — SoftHSM configuration file reference
  • openssl(1) — general-purpose key conversion
  • dnssec-keygen(1) — BIND DNSSEC key generation

Build docs developers (and LLMs) love

Get started for freeTalk to us