a2a915
diff --git a/bin/Makefile.in b/bin/Makefile.in
a2a915
index f0c504a..ce7a2da 100644
a2a915
--- a/bin/Makefile.in
a2a915
+++ b/bin/Makefile.in
a2a915
@@ -11,8 +11,8 @@ srcdir =	@srcdir@
a2a915
 VPATH =		@srcdir@
a2a915
 top_srcdir =	@top_srcdir@
a2a915
 
a2a915
-SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
a2a915
-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
a2a915
+SUBDIRS =	named named-pkcs11 rndc dig delv dnssec dnssec-pkcs11 tools nsupdate \
a2a915
+		check confgen @NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
a2a915
 TARGETS =
a2a915
 
a2a915
 @BIND9_MAKE_RULES@
a2a915
diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
a2a915
index 1d0c4ce..7b7f89b 100644
a2a915
--- a/bin/dnssec-pkcs11/Makefile.in
a2a915
+++ b/bin/dnssec-pkcs11/Makefile.in
a2a915
@@ -17,18 +17,18 @@ VERSION=@BIND9_VERSION@
a2a915
 
a2a915
 @BIND9_MAKE_INCLUDES@
a2a915
 
a2a915
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
a2a915
+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES}
a2a915
 
a2a915
 CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
a2a915
-		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
a2a915
+		@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
a2a915
 CWARNINGS =
a2a915
 
a2a915
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
a2a915
-ISCLIBS =	../../lib/isc/libisc.@A@
a2a915
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
a2a915
+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
a2a915
+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
a2a915
+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@
a2a915
 
a2a915
-DNSDEPLIBS =	../../lib/dns/libdns.@A@
a2a915
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
a2a915
+DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
a2a915
+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
a2a915
 
a2a915
 DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
a2a915
 
a2a915
@@ -37,10 +37,10 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
a2a915
 NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
a2a915
 
a2a915
 # Alphabetically
a2a915
-TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
a2a915
-		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
a2a915
-		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
a2a915
-		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
a2a915
+TARGETS =	dnssec-keygen-pkcs11@EXEEXT@ dnssec-signzone-pkcs11@EXEEXT@ \
a2a915
+		dnssec-keyfromlabel-pkcs11@EXEEXT@ dnssec-dsfromkey-pkcs11@EXEEXT@ \
a2a915
+		dnssec-revoke-pkcs11@EXEEXT@ dnssec-settime-pkcs11@EXEEXT@ \
a2a915
+		dnssec-verify-pkcs11@EXEEXT@ dnssec-importkey-pkcs11@EXEEXT@
a2a915
 
a2a915
 OBJS =		dnssectool.@O@
a2a915
 
a2a915
@@ -61,15 +61,15 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
a2a915
 
a2a915
 @BIND9_MAKE_RULES@
a2a915
 
a2a915
-dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-dsfromkey-pkcs11@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
a2a915
 	${FINALBUILDCMD}
a2a915
 
a2a915
-dnssec-keyfromlabel@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-keyfromlabel-pkcs11@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	export BASEOBJS="dnssec-keyfromlabel.@O@ ${OBJS}"; \
a2a915
 	${FINALBUILDCMD}
a2a915
 
a2a915
-dnssec-keygen@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-keygen-pkcs11@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	export BASEOBJS="dnssec-keygen.@O@ ${OBJS}"; \
a2a915
 	${FINALBUILDCMD}
a2a915
 
a2a915
@@ -77,7 +77,7 @@ dnssec-signzone.@O@: dnssec-signzone.c
a2a915
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
a2a915
 		-c ${srcdir}/dnssec-signzone.c
a2a915
 
a2a915
-dnssec-signzone@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-signzone-pkcs11@EXEEXT@: dnssec-signzone.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	export BASEOBJS="dnssec-signzone.@O@ ${OBJS}"; \
a2a915
 	${FINALBUILDCMD}
a2a915
 
a2a915
@@ -85,19 +85,19 @@ dnssec-verify.@O@: dnssec-verify.c
a2a915
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
a2a915
 		-c ${srcdir}/dnssec-verify.c
a2a915
 
a2a915
-dnssec-verify@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-verify-pkcs11@EXEEXT@: dnssec-verify.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	export BASEOBJS="dnssec-verify.@O@ ${OBJS}"; \
a2a915
 	${FINALBUILDCMD}
a2a915
 
a2a915
-dnssec-revoke@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-revoke-pkcs11@EXEEXT@: dnssec-revoke.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
a2a915
 	dnssec-revoke.@O@ ${OBJS} ${LIBS}
a2a915
 
a2a915
-dnssec-settime@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-settime-pkcs11@EXEEXT@: dnssec-settime.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
a2a915
 	dnssec-settime.@O@ ${OBJS} ${LIBS}
a2a915
 
a2a915
-dnssec-importkey@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
a2a915
+dnssec-importkey-pkcs11@EXEEXT@: dnssec-importkey.@O@ ${OBJS} ${DEPLIBS}
a2a915
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
a2a915
 	dnssec-importkey.@O@ ${OBJS} ${LIBS}
a2a915
 
a2a915
@@ -108,16 +108,14 @@ docclean manclean maintainer-clean::
a2a915
 
a2a915
 installdirs:
a2a915
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
a2a915
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
a2a915
 
a2a915
 install-man8: ${MANPAGES}
a2a915
 	${INSTALL_DATA} $^ ${DESTDIR}${mandir}/man8
a2a915
 
a2a915
-install:: ${TARGETS} installdirs install-man8
a2a915
+install:: ${TARGETS} installdirs
a2a915
 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
a2a915
 
a2a915
 uninstall::
a2a915
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
a2a915
 	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done
a2a915
 
a2a915
 clean distclean::
a2a915
diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
a2a915
index 1d0c4ce..11538cf 100644
a2a915
--- a/bin/dnssec/Makefile.in
a2a915
+++ b/bin/dnssec/Makefile.in
a2a915
@@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
a2a915
 
a2a915
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
a2a915
 
a2a915
-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
a2a915
+CDEFINES =	-DVERSION=\"${VERSION}\" \
a2a915
 		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
a2a915
 CWARNINGS =
a2a915
 
a2a915
diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
a2a915
index d92bc9a..a8c42a4 100644
a2a915
--- a/bin/named-pkcs11/Makefile.in
a2a915
+++ b/bin/named-pkcs11/Makefile.in
a2a915
@@ -43,26 +43,26 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
a2a915
 DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
a2a915
 
a2a915
 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
a2a915
-		${LWRES_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} \
a2a915
-		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
a2a915
+        ${LWRES_INCLUDES} ${DNS_PKCS11_INCLUDES} ${BIND9_INCLUDES} \
a2a915
+        ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_PKCS11_INCLUDES} \
a2a915
 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
a2a915
 
a2a915
-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
a2a915
+CDEFINES =      @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO_PK11@
a2a915
 
a2a915
 CWARNINGS =
a2a915
 
a2a915
-DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
a2a915
+DNSLIBS =  ../../lib/dns-pkcs11/libdns-pkcs11.@A@ @DNS_CRYPTO_LIBS@
a2a915
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
a2a915
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
a2a915
-ISCLIBS =	../../lib/isc/libisc.@A@
a2a915
+ISCLIBS =  ../../lib/isc-pkcs11/libisc-pkcs11.@A@
a2a915
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
a2a915
 LWRESLIBS =	../../lib/lwres/liblwres.@A@
a2a915
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
a2a915
 
a2a915
-DNSDEPLIBS =	../../lib/dns/libdns.@A@
a2a915
+DNSDEPLIBS =   ../../lib/dns-pkcs11/libdns-pkcs11.@A@
a2a915
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
a2a915
 ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
a2a915
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
a2a915
+ISCDEPLIBS =   ../../lib/isc-pkcs11/libisc-pkcs11.@A@
a2a915
 LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
a2a915
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
a2a915
 
a2a915
@@ -71,15 +71,15 @@ DEPLIBS =	${LWRESDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
a2a915
 
a2a915
 LIBS =		${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
a2a915
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
a2a915
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
a2a915
+		@LIBS@
a2a915
 
a2a915
 NOSYMLIBS =	${LWRESLIBS} ${DNSLIBS} ${BIND9LIBS} \
a2a915
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
a2a915
-		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBS@
a2a915
+        @LIBS@
a2a915
 
a2a915
 SUBDIRS =	unix
a2a915
 
a2a915
-TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
a2a915
+TARGETS =  named-pkcs11@EXEEXT@
a2a915
 
a2a915
 GEOIPLINKOBJS = geoip.@O@
a2a915
 
a2a915
@@ -90,8 +90,7 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
a2a915
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
a2a915
 		zoneconf.@O@ \
a2a915
 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
a2a915
-		lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@ \
a2a915
-		${DLZDRIVER_OBJS} ${DBDRIVER_OBJS}
a2a915
+        lwdgnba.@O@ lwdgrbn.@O@ lwdnoop.@O@ lwsearch.@O@
a2a915
 
a2a915
 UOBJS =		unix/os.@O@ unix/dlz_dlopen_driver.@O@
a2a915
 
a2a915
@@ -106,8 +105,7 @@ SRCS =		builtin.c client.c config.c control.c \
a2a915
 		tkeyconf.c tsigconf.c update.c xfrout.c \
a2a915
 		zoneconf.c \
a2a915
 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
a2a915
-		lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c \
a2a915
-		${DLZDRIVER_SRCS} ${DBDRIVER_SRCS}
a2a915
+        lwdgnba.c lwdgrbn.c lwdnoop.c lwsearch.c
a2a915
 
a2a915
 MANPAGES =	named.8 lwresd.8 named.conf.5
a2a915
 
a2a915
@@ -146,14 +144,14 @@ server.@O@: server.c
a2a915
 		-DPRODUCT=\"${PRODUCT}\" \
a2a915
 		-DVERSION=\"${VERSION}\" -c ${srcdir}/server.c
a2a915
 
a2a915
-named@EXEEXT@: ${OBJS} ${DEPLIBS}
a2a915
+named-pkcs11@EXEEXT@: ${OBJS} ${DEPLIBS}
a2a915
 	export MAKE_SYMTABLE="yes"; \
a2a915
 	export BASEOBJS="${OBJS} ${UOBJS}"; \
a2a915
 	${FINALBUILDCMD}
a2a915
 
a2a915
-lwresd@EXEEXT@: named@EXEEXT@
a2a915
+lwresd@EXEEXT@: named-pkcs11@EXEEXT@
a2a915
 	rm -f lwresd@EXEEXT@
a2a915
-	@LN@ named@EXEEXT@ lwresd@EXEEXT@
a2a915
+	@LN@ named-pkcs11@EXEEXT@ lwresd@EXEEXT@
a2a915
 
a2a915
 doc man:: ${MANOBJS}
a2a915
 
a2a915
@@ -184,16 +182,11 @@ install-man8: named.8 lwresd.8
a2a915
 
a2a915
 install-man: install-man5 install-man8
a2a915
 
a2a915
-install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs install-man
a2a915
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named@EXEEXT@ ${DESTDIR}${sbindir}
a2a915
-	(cd ${DESTDIR}${sbindir}; rm -f lwresd@EXEEXT@; @LN@ named@EXEEXT@ lwresd@EXEEXT@)
a2a915
+install:: named-pkcs11@EXEEXT@ installdirs
a2a915
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-pkcs11@EXEEXT@ ${DESTDIR}${sbindir}
a2a915
 
a2a915
 uninstall::
a2a915
-	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
a2a915
-	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
a2a915
-	rm -f ${DESTDIR}${mandir}/man8/named.8
a2a915
-	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
a2a915
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
a2a915
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-pkcs11@EXEEXT@
a2a915
 
a2a915
 @DLZ_DRIVER_RULES@
a2a915
 
a2a915
diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
a2a915
index d92bc9a..6d2bfd1 100644
a2a915
--- a/bin/named/Makefile.in
a2a915
+++ b/bin/named/Makefile.in
a2a915
@@ -47,7 +47,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
a2a915
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} ${ISC_INCLUDES} \
a2a915
 		${DLZDRIVER_INCLUDES} ${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@
a2a915
 
a2a915
-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
a2a915
+CDEFINES =      @CONTRIB_DLZ@ @CRYPTO@
a2a915
 
a2a915
 CWARNINGS =
a2a915
 
a2a915
diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
a2a915
index 70ee8b5..0fd8644 100644
a2a915
--- a/bin/pkcs11/Makefile.in
a2a915
+++ b/bin/pkcs11/Makefile.in
a2a915
@@ -15,13 +15,13 @@ top_srcdir =	@top_srcdir@
a2a915
 
a2a915
 @BIND9_MAKE_INCLUDES@
a2a915
 
a2a915
-CINCLUDES =	${ISC_INCLUDES}
a2a915
+CINCLUDES =	${ISC_PKCS11_INCLUDES}
a2a915
 
a2a915
 CDEFINES =
a2a915
 
a2a915
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
a2a915
+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @ISC_OPENSSL_LIBS@
a2a915
 
a2a915
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
a2a915
+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
a2a915
 
a2a915
 DEPLIBS =	${ISCDEPLIBS}
a2a915
 
a2a915
diff --git a/configure.in b/configure.in
a2a915
index 9a1d16d..2f13059 100644
a2a915
--- a/configure.in
a2a915
+++ b/configure.in
a2a915
@@ -1164,12 +1164,14 @@ AC_SUBST(USE_GSSAPI)
a2a915
 AC_SUBST(DST_GSSAPI_INC)
a2a915
 AC_SUBST(DNS_GSSAPI_LIBS)
a2a915
 DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"
a2a915
+DNS_CRYPTO_PK11_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_PK11_LIBS"
a2a915
 
a2a915
 #
a2a915
 # Applications linking with libdns also need to link with these libraries.
a2a915
 #
a2a915
 
a2a915
 AC_SUBST(DNS_CRYPTO_LIBS)
a2a915
+AC_SUBST(DNS_CRYPTO_PK11_LIBS)
a2a915
 
a2a915
 #
a2a915
 # was --with-randomdev specified?
a2a915
@@ -1554,11 +1556,11 @@ fi
a2a915
 AC_MSG_CHECKING(for OpenSSL library)
a2a915
 OPENSSL_WARNING=
a2a915
 openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
a2a915
-if test "yes" = "$want_native_pkcs11"
a2a915
-then
a2a915
-	use_openssl="native_pkcs11"
a2a915
-	AC_MSG_RESULT(use of native PKCS11 instead)
a2a915
-fi
a2a915
+# if test "yes" = "$want_native_pkcs11"
a2a915
+# then
a2a915
+# 	use_openssl="native_pkcs11"
a2a915
+# 	AC_MSG_RESULT(use of native PKCS11 instead)
a2a915
+# fi
a2a915
 
a2a915
 if test "auto" = "$use_openssl"
a2a915
 then
a2a915
@@ -1571,6 +1573,7 @@ then
a2a915
 		fi
a2a915
 	done
a2a915
 fi
a2a915
+CRYPTO_PK11=""
a2a915
 OPENSSL_ECDSA=""
a2a915
 OPENSSL_GOST=""
a2a915
 OPENSSL_ED25519=""
a2a915
@@ -1592,11 +1595,10 @@ case "$with_gost" in
a2a915
 		;;
a2a915
 esac
a2a915
 
a2a915
-case "$use_openssl" in
a2a915
-	native_pkcs11)
a2a915
-		AC_MSG_RESULT(disabled because of native PKCS11)
a2a915
+if test "$want_native_pkcs11" = "yes"
a2a915
+then
a2a915
 		DST_OPENSSL_INC=""
a2a915
-		CRYPTO="-DPKCS11CRYPTO"
a2a915
+		CRYPTO_PK11="-DPKCS11CRYPTO"
a2a915
 		OPENSSLECDSALINKOBJS=""
a2a915
 		OPENSSLECDSALINKSRCS=""
a2a915
 		OPENSSLEDDSALINKOBJS=""
a2a915
@@ -1605,7 +1607,9 @@ case "$use_openssl" in
a2a915
 		OPENSSLGOSTLINKSRCS=""
a2a915
 		OPENSSLLINKOBJS=""
a2a915
 		OPENSSLLINKSRCS=""
a2a915
-		;;
a2a915
+fi
a2a915
+
a2a915
+case "$use_openssl" in
a2a915
 	no)
a2a915
 		AC_MSG_RESULT(no)
a2a915
 		DST_OPENSSL_INC=""
a2a915
@@ -1635,11 +1639,11 @@ case "$use_openssl" in
a2a915
 If you don't want OpenSSL, use --without-openssl])
a2a915
 		;;
a2a915
 	*)
a2a915
-		if test "yes" = "$want_native_pkcs11"
a2a915
-		then
a2a915
-			AC_MSG_RESULT()
a2a915
-			AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
a2a915
-		fi
a2a915
+		# if test "yes" = "$want_native_pkcs11"
a2a915
+		# then
a2a915
+		# 	AC_MSG_RESULT()
a2a915
+		# 	AC_MSG_ERROR([OpenSSL and native PKCS11 cannot be used together.])
a2a915
+		# fi
a2a915
 		if test "yes" = "$use_openssl"
a2a915
 		then
a2a915
 			# User did not specify a path - guess it
a2a915
@@ -2062,6 +2066,7 @@ AC_SUBST(OPENSSL_ED25519)
a2a915
 AC_SUBST(OPENSSL_GOST)
a2a915
 
a2a915
 DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DST_OPENSSL_LIBS"
a2a915
+DNS_CRYPTO_PK11_LIBS="$DNS_CRYPTO_LIBS"
a2a915
 
a2a915
 ISC_PLATFORM_WANTAES="#undef ISC_PLATFORM_WANTAES"
a2a915
 if test "yes" = "$with_aes"
a2a915
@@ -2381,6 +2386,7 @@ esac
a2a915
 AC_SUBST(PKCS11LINKOBJS)
a2a915
 AC_SUBST(PKCS11LINKSRCS)
a2a915
 AC_SUBST(CRYPTO)
a2a915
+AC_SUBST(CRYPTO_PK11)
a2a915
 AC_SUBST(PKCS11_ECDSA)
a2a915
 AC_SUBST(PKCS11_GOST)
a2a915
 AC_SUBST(PKCS11_ED25519)
a2a915
@@ -5434,8 +5440,11 @@ AC_CONFIG_FILES([
a2a915
 	bin/delv/Makefile
a2a915
 	bin/dig/Makefile
a2a915
 	bin/dnssec/Makefile
a2a915
+	bin/dnssec-pkcs11/Makefile	
a2a915
 	bin/named/Makefile
a2a915
 	bin/named/unix/Makefile
a2a915
+	bin/named-pkcs11/Makefile
a2a915
+	bin/named-pkcs11/unix/Makefile
a2a915
 	bin/nsupdate/Makefile
a2a915
 	bin/pkcs11/Makefile
a2a915
 	bin/python/Makefile
a2a915
@@ -5509,6 +5518,10 @@ AC_CONFIG_FILES([
a2a915
 	lib/dns/include/dns/Makefile
a2a915
 	lib/dns/include/dst/Makefile
a2a915
 	lib/dns/tests/Makefile
a2a915
+	lib/dns-pkcs11/Makefile
a2a915
+	lib/dns-pkcs11/include/Makefile
a2a915
+	lib/dns-pkcs11/include/dns/Makefile
a2a915
+	lib/dns-pkcs11/include/dst/Makefile
a2a915
 	lib/irs/Makefile
a2a915
 	lib/irs/include/Makefile
a2a915
 	lib/irs/include/irs/Makefile
a2a915
@@ -5533,6 +5546,24 @@ AC_CONFIG_FILES([
a2a915
 	lib/isc/unix/include/Makefile
a2a915
 	lib/isc/unix/include/isc/Makefile
a2a915
 	lib/isc/unix/include/pkcs11/Makefile
a2a915
+	lib/isc-pkcs11/$arch/Makefile
a2a915
+	lib/isc-pkcs11/$arch/include/Makefile
a2a915
+	lib/isc-pkcs11/$arch/include/isc/Makefile
a2a915
+	lib/isc-pkcs11/$thread_dir/Makefile
a2a915
+	lib/isc-pkcs11/$thread_dir/include/Makefile
a2a915
+	lib/isc-pkcs11/$thread_dir/include/isc/Makefile
a2a915
+	lib/isc-pkcs11/Makefile
a2a915
+	lib/isc-pkcs11/include/Makefile
a2a915
+	lib/isc-pkcs11/include/isc/Makefile
a2a915
+	lib/isc-pkcs11/include/isc/platform.h
a2a915
+	lib/isc-pkcs11/include/pk11/Makefile
a2a915
+	lib/isc-pkcs11/include/pkcs11/Makefile
a2a915
+	lib/isc-pkcs11/tests/Makefile
a2a915
+	lib/isc-pkcs11/nls/Makefile
a2a915
+	lib/isc-pkcs11/unix/Makefile
a2a915
+	lib/isc-pkcs11/unix/include/Makefile
a2a915
+	lib/isc-pkcs11/unix/include/isc/Makefile
a2a915
+	lib/isc-pkcs11/unix/include/pkcs11/Makefile
a2a915
 	lib/isccc/Makefile
a2a915
 	lib/isccc/include/Makefile
a2a915
 	lib/isccc/include/isccc/Makefile
a2a915
diff --git a/lib/Makefile.in b/lib/Makefile.in
a2a915
index 81270a0..bcb5312 100644
a2a915
--- a/lib/Makefile.in
a2a915
+++ b/lib/Makefile.in
a2a915
@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
a2a915
 # Attempt to disable parallel processing.
a2a915
 .NOTPARALLEL:
a2a915
 .NO_PARALLEL:
a2a915
-SUBDIRS =	isc isccc dns isccfg bind9 lwres irs samples
a2a915
+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 isccfg bind9 lwres irs samples
a2a915
 TARGETS =
a2a915
 
a2a915
 @BIND9_MAKE_RULES@
a2a915
diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
a2a915
index 4a8549e..6a19906 100644
a2a915
--- a/lib/dns-pkcs11/Makefile.in
a2a915
+++ b/lib/dns-pkcs11/Makefile.in
a2a915
@@ -26,16 +26,16 @@ VERSION=@BIND9_VERSION@
a2a915
 
a2a915
 USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
a2a915
 
a2a915
-CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
a2a915
-		${ISC_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
a2a915
+CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
a2a915
+		${ISC_PKCS11_INCLUDES} @DST_OPENSSL_INC@ @DST_GSSAPI_INC@
a2a915
 
a2a915
-CDEFINES =	-DUSE_MD5 @CRYPTO@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
a2a915
+CDEFINES =	-DUSE_MD5 @CRYPTO_PK11@ @USE_GSSAPI@ ${USE_ISC_SPNEGO}
a2a915
 
a2a915
 CWARNINGS =
a2a915
 
a2a915
-ISCLIBS =	../../lib/isc/libisc.@A@
a2a915
+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
a2a915
 
a2a915
-ISCDEPLIBS =	../../lib/isc/libisc.@A@
a2a915
+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
a2a915
 
a2a915
 LIBS =		@LIBS@
a2a915
 
a2a915
@@ -146,15 +146,15 @@ version.@O@: version.c
a2a915
 		-DLIBAGE=${LIBAGE} \
a2a915
 		-c ${srcdir}/version.c
a2a915
 
a2a915
-libdns.@SA@: ${OBJS}
a2a915
+libdns-pkcs11.@SA@: ${OBJS}
a2a915
 	${AR} ${ARFLAGS} $@ ${OBJS}
a2a915
 	${RANLIB} $@
a2a915
 
a2a915
-libdns.la: ${OBJS}
a2a915
+libdns-pkcs11.la: ${OBJS}
a2a915
 	${LIBTOOL_MODE_LINK} \
a2a915
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
a2a915
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-pkcs11.la -rpath ${libdir} \
a2a915
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
a2a915
-		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
a2a915
+		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
a2a915
 
a2a915
 include: gen
a2a915
 	${MAKE} include/dns/enumtype.h
a2a915
@@ -180,25 +180,25 @@ code.h:	gen
a2a915
 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
a2a915
 
a2a915
 gen: gen.c
a2a915
-	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
a2a915
+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
a2a915
 	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c ${BUILD_LIBS}
a2a915
 
a2a915
-timestamp: include libdns.@A@
a2a915
+timestamp: include libdns-pkcs11.@A@
a2a915
 	touch timestamp
a2a915
 
a2a915
-testdirs: libdns.@A@
a2a915
+testdirs: libdns-pkcs11.@A@
a2a915
 
a2a915
 installdirs:
a2a915
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
a2a915
 
a2a915
 install:: timestamp installdirs
a2a915
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns.@A@ ${DESTDIR}${libdir}
a2a915
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libdns-pkcs11.@A@ ${DESTDIR}${libdir}
a2a915
 
a2a915
 uninstall::
a2a915
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns.@A@
a2a915
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libdns-pkcs11.@A@
a2a915
 
a2a915
 clean distclean::
a2a915
-	rm -f libdns.@A@ timestamp
a2a915
+	rm -f libdns-pkcs11.@A@ timestamp
a2a915
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
a2a915
 	rm -f include/dns/rdatastruct.h
a2a915
 	rm -f dnstap.pb-c.c dnstap.pb-c.h include/dns/dnstap.pb-c.h
a2a915
diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
a2a915
index ba53ef1..d1f1771 100644
a2a915
--- a/lib/isc-pkcs11/Makefile.in
a2a915
+++ b/lib/isc-pkcs11/Makefile.in
a2a915
@@ -23,8 +23,8 @@ CINCLUDES =	-I${srcdir}/unix/include \
a2a915
 		-I${srcdir}/@ISC_THREAD_DIR@/include \
a2a915
 		-I${srcdir}/@ISC_ARCH_DIR@/include \
a2a915
 		-I./include \
a2a915
-		-I${srcdir}/include ${DNS_INCLUDES} @ISC_OPENSSL_INC@
a2a915
-CDEFINES =	@CRYPTO@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
a2a915
+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES}
a2a915
+CDEFINES =	@CRYPTO_PK11@ -DPK11_LIB_LOCATION=\"${PROVIDER}\"
a2a915
 CWARNINGS =
a2a915
 
a2a915
 # Alphabetically
a2a915
@@ -107,40 +107,40 @@ version.@O@: version.c
a2a915
 		-DLIBAGE=${LIBAGE} \
a2a915
 		-c ${srcdir}/version.c
a2a915
 
a2a915
-libisc.@SA@: ${OBJS} ${SYMTBLOBJS}
a2a915
+libisc-pkcs11.@SA@: ${OBJS} ${SYMTBLOBJS}
a2a915
 	${AR} ${ARFLAGS} $@ ${OBJS} ${SYMTBLOBJS}
a2a915
 	${RANLIB} $@
a2a915
 
a2a915
-libisc-nosymtbl.@SA@: ${OBJS}
a2a915
+libisc-pkcs11-nosymtbl.@SA@: ${OBJS}
a2a915
 	${AR} ${ARFLAGS} $@ ${OBJS}
a2a915
 	${RANLIB} $@
a2a915
 
a2a915
-libisc.la: ${OBJS} ${SYMTBLOBJS}
a2a915
+libisc-pkcs11.la: ${OBJS} ${SYMTBLOBJS}
a2a915
 	${LIBTOOL_MODE_LINK} \
a2a915
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
a2a915
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11.la -rpath ${libdir} \
a2a915
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
a2a915
 		${OBJS} ${SYMTBLOBJS} ${LIBS}
a2a915
 
a2a915
-libisc-nosymtbl.la: ${OBJS}
a2a915
+libisc-pkcs11-nosymtbl.la: ${OBJS}
a2a915
 	${LIBTOOL_MODE_LINK} \
a2a915
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
a2a915
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11-nosymtbl.la -rpath ${libdir} \
a2a915
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
a2a915
 		${OBJS} ${LIBS}
a2a915
 
a2a915
-timestamp: libisc.@A@ libisc-nosymtbl.@A@
a2a915
+timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
a2a915
 	touch timestamp
a2a915
 
a2a915
-testdirs: libisc.@A@ libisc-nosymtbl.@A@
a2a915
+testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
a2a915
 
a2a915
 installdirs:
a2a915
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
a2a915
 
a2a915
 install:: timestamp installdirs
a2a915
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
a2a915
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
a2a915
 
a2a915
 uninstall::
a2a915
-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
a2a915
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
a2a915
 
a2a915
 clean distclean::
a2a915
-	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
a2a915
-	libisc-nosymtbl.la timestamp
a2a915
+	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
a2a915
+	libisc-pkcs11-nosymtbl.la timestamp
a2a915
diff --git a/make/includes.in b/make/includes.in
a2a915
index fa86ad1..3cfbe9f 100644
a2a915
--- a/make/includes.in
a2a915
+++ b/make/includes.in
a2a915
@@ -43,3 +43,13 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
a2a915
 
a2a915
 TEST_INCLUDES = \
a2a915
 	-I${top_srcdir}/lib/tests/include
a2a915
+
a2a915
+ISC_PKCS11_INCLUDES = @BIND9_ISC_BUILDINCLUDE@ \
a2a915
+	-I${top_srcdir}/lib/isc-pkcs11 \
a2a915
+	-I${top_srcdir}/lib/isc-pkcs11/include \
a2a915
+	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
a2a915
+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_THREAD_DIR@/include \
a2a915
+	-I${top_srcdir}/lib/isc-pkcs11/@ISC_ARCH_DIR@/include
a2a915
+
a2a915
+DNS_PKCS11_INCLUDES = @BIND9_DNS_BUILDINCLUDE@ \
a2a915
+	-I${top_srcdir}/lib/dns-pkcs11/include