Skip to main content
This document provides information about configuring the Vectera Plus HSM with BIND by using Futurex PKCS #11 libraries. For additional questions related to your HSM, see the relevant user guide.

​
About BIND

BIND is a software suite for interacting with the DNS. Its most prominent component, named (the name daemon on Linux), performs both primary DNS server roles, acting as an authoritative name server for DNS zones and as a recursive resolver within the network. As of 2015, it is the most widely used domain name server software and is the de facto standard on Unix-like operating systems. Also contained in the suite are various administrative tools, such as nsupdate and dig, as well as a DNS resolver interface library.

​
How the BIND integration works

The integration involves the following steps:
  1. Zone data creation or update: User defines or updates DNS zone file.
  2. Key reference request: BIND identifies required signing keys.
  3. HSM login: BIND authenticates to the Vectera Plus by using PKCS#11.
  4. Signing key access: Vectera Plus locates the requested signing keys.
  5. Signing operation: Vectera Plus generates digital signatures by using private keys.
  6. Zone file update: Signed DNS records are added to the zone data.
  7. Zone publication: BIND loads and serves the signed zone.
  8. Resolver validation: DNS resolvers verify signatures by using Domain Name Security System Extensions (DNSSEC) public keys.

​
PKCS #11 in BIND

The PKCS #11 support in BIND comes in two forms:
  • Native PKCS #11: BIND interfaces directly with the Vectera Plus provided library through the PKCS #11 API. This allows BIND to interact directly with the PKCS #11 provider for public key cryptography (DNSSEC).
  • OpenSSL-based PKCS #11: BIND uses an OpenSSL PKCS #11 provider (such as pkcs11-provider from the Latchset project) to interact with Vectera Plus indirectly.
This integration guide uses the OpenSSL-based PKCS #11 method because it is the only method compatible with Vectera Plus.

​
Guardian integration

The Guardian Series 3 introduces mission-critical viability to core cryptographic infrastructure, including:
  • Centralization of device management
  • Elimination of points of failure
  • Distribution of transaction loads
  • Group-specific function blocking
  • User-defined grouping systems
See the applicable guide in the Futurex Portal for configuring HSMs with the Guardian Series 3, including PKCS #11 and CNG configuration.