NB! This feature is experimental, and not ready for production. Use at your own risk!
To enable it, compile PowerDNS Authoritative Server using --experimental-pkcs11-support flag. This requires you to have p11-kit libraries and headers.
Instructions on how to setup SoftHSM to work with the feature after compilation on ubuntu/debian.
apt-get install softhsm p11-kit
create directory /etc/pkcs11/modules
Add file called 'softhsm' there with (on some versions, use softhsm.module)
module: /home/cmouse/softhsm/lib/softhsm/libsofthsm.so managed: yes
Run p11-kit -l to verify it worked (you should see softhsm there)
Create at least two tokens (ksk and zsk) with (slot-number starts from 0)
softhsm --init-token --slot slot-number --label zone-ksk|zone-zsk --pin some-pin --so-pin another-pin
Run p11-kit -l to verify it worked (you should see softhsm there and tokens)
Assign the keys using
pdnssec hsm assign zone rsasha256 ksk|zsk softhsm slot-id pin zone-ksk|zsk
Take note of the generated key id, if it always shows up 1, run pdnssec show-zone zone to retrieve them
Generate the keys using
pdnssec hsm create-key zone key-id
Verify that everything worked with pdnssec show-zone zone, you should see valid data there
Enjoy using PKCS#11!