diff --git a/bind-9.10-dist-native-pkcs11.patch b/bind-9.10-dist-native-pkcs11.patch
index c255fab..c1b479a 100644
--- a/bind-9.10-dist-native-pkcs11.patch
+++ b/bind-9.10-dist-native-pkcs11.patch
@@ -11,34 +11,56 @@ index 9ad7f62..094775a 100644
  		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
  TARGETS =
  
+diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
+index 1e0fe0e..dc3a7f6 100644
+--- a/bin/confgen/Makefile.in
++++ b/bin/confgen/Makefile.in
+@@ -22,7 +22,7 @@ VERSION=@BIND9_VERSION@
+ CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
+ 	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+ 
+-CDEFINES = @USE_PKCS11@
++CDEFINES =
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
+diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
+index 2317ec0..0601939 100644
+--- a/bin/dig/Makefile.in
++++ b/bin/dig/Makefile.in
+@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
+ 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
+ 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
+ 
+-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
++CDEFINES =	-DVERSION=\"${VERSION}\"
+ CWARNINGS =
+ 
+ ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 321058b..5067ee1 100644
+index 1dad340..ffac64e 100644
 --- a/bin/dnssec-pkcs11/Makefile.in
 +++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
+@@ -15,16 +15,16 @@ VERSION=@BIND9_VERSION@
  
  @BIND9_MAKE_INCLUDES@
  
 -CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
++CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
  
- CDEFINES =	-DVERSION=\"${VERSION}\"
+ CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
  CWARNINGS =
  
 -DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
  
  DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
- 
 @@ -34,11 +34,11 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
  NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
  
@@ -131,47 +153,57 @@ index 321058b..5067ee1 100644
  	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
  
  clean distclean::
+diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
+index 1dad340..321058b 100644
+--- a/bin/dnssec/Makefile.in
++++ b/bin/dnssec/Makefile.in
+@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
+ 
+ CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+ 
+-CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@
++CDEFINES =	-DVERSION=\"${VERSION}\"
+ CWARNINGS =
+ 
+ DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
 diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index eecfa76..416e12e 100644
+index e5b0d4b..b739869 100644
 --- a/bin/named-pkcs11/Makefile.in
 +++ b/bin/named-pkcs11/Makefile.in
-@@ -43,9 +43,9 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
+@@ -43,7 +43,7 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
  DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
  
  CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 -		${NS_INCLUDES} ${DNS_INCLUDES} \
-+		${NS_INCLUDES} ${DNS_PKCS11_INCLUDES} \
++		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
  		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
--		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
+ 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
  		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@
- 
-@@ -53,18 +53,18 @@ CDEFINES =      @CONTRIB_DLZ@
+@@ -53,37 +53,37 @@ CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
  
  CWARNINGS =
  
 -DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
  ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCLIBS =	../../lib/isccc/libisccc.@A@
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
+ ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
  BIND9LIBS =	../../lib/bind9/libbind9.@A@
- NSLIBS =	../../lib/ns/libns.@A@
+-NSLIBS =	../../lib/ns/libns.@A@
++NSLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
  
 -DNSDEPLIBS =	../../lib/dns/libdns.@A@
 +DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
  ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
  ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
  BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
- NSDEPLIBS =	../../lib/ns/libns.@A@
+-NSDEPLIBS =	../../lib/ns/libns.@A@
++NSDEPLIBS =	../../lib/ns-pkcs11/libns-pkcs11.@A@
  
-@@ -73,17 +73,17 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
+ 		${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${ISCDEPLIBS}
  
  LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
  		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
@@ -247,32 +279,24 @@ index eecfa76..416e12e 100644
  
  @DLZ_DRIVER_RULES@
  
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 96aec05..0e542f3 100644
---- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	${ISC_INCLUDES}
-+CINCLUDES =	${ISC_PKCS11_INCLUDES}
- 
- CDEFINES =
- 
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
+diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
+index e5b0d4b..eecfa76 100644
+--- a/bin/named/Makefile.in
++++ b/bin/named/Makefile.in
+@@ -49,7 +49,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
+ 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@
  
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
+-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@
++CDEFINES =      @CONTRIB_DLZ@
  
- DEPLIBS =	${ISCDEPLIBS}
+ CWARNINGS =
  
 diff --git a/configure.ac b/configure.ac
-index 29106cb..3dff344 100644
+index 6cce3bb..d80ae31 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -1267,12 +1267,14 @@ AC_SUBST(USE_GSSAPI)
+@@ -1276,12 +1276,14 @@ AC_SUBST(USE_GSSAPI)
  AC_SUBST(DST_GSSAPI_INC)
  AC_SUBST(DNS_GSSAPI_LIBS)
  DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
@@ -287,37 +311,34 @@ index 29106cb..3dff344 100644
  
  #
  # was --with-lmdb specified?
-@@ -2542,6 +2544,9 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
+@@ -2522,6 +2524,8 @@ AC_SUBST(BIND9_DNS_BUILDINCLUDE)
  AC_SUBST(BIND9_NS_BUILDINCLUDE)
  AC_SUBST(BIND9_BIND9_BUILDINCLUDE)
  AC_SUBST(BIND9_IRS_BUILDINCLUDE)
-+AC_SUBST(BIND9_ISC_PKCS11_BUILDINCLUDE)
 +AC_SUBST(BIND9_DNS_PKCS11_BUILDINCLUDE)
 +AC_SUBST(BIND9_NS_PKCS11_BUILDINCLUDE)
  if test "X$srcdir" != "X"; then
  	BIND9_ISC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc/include"
  	BIND9_ISCCC_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isccc/include"
-@@ -2550,6 +2555,9 @@ if test "X$srcdir" != "X"; then
+@@ -2530,6 +2534,8 @@ if test "X$srcdir" != "X"; then
  	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
  	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
  	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
-+	BIND9_ISC_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc-pkcs11/include"
 +	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
 +	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
  else
  	BIND9_ISC_BUILDINCLUDE=""
  	BIND9_ISCCC_BUILDINCLUDE=""
-@@ -2558,6 +2566,9 @@ else
+@@ -2538,6 +2544,8 @@ else
  	BIND9_NS_BUILDINCLUDE=""
  	BIND9_BIND9_BUILDINCLUDE=""
  	BIND9_IRS_BUILDINCLUDE=""
-+	BIND9_ISC_PKCS11_BUILDINCLUDE=""
 +	BIND9_DNS_PKCS11_BUILDINCLUDE=""
 +	BIND9_NS_PKCS11_BUILDINCLUDE=""
  fi
  
  AC_SUBST_FILE(BIND9_MAKE_INCLUDES)
-@@ -3021,8 +3032,11 @@ AC_CONFIG_FILES([
+@@ -3001,8 +3009,11 @@ AC_CONFIG_FILES([
  	bin/delv/Makefile
  	bin/dig/Makefile
  	bin/dnssec/Makefile
@@ -329,7 +350,7 @@ index 29106cb..3dff344 100644
  	bin/nsupdate/Makefile
  	bin/pkcs11/Makefile
  	bin/plugins/Makefile
-@@ -3095,6 +3109,10 @@ AC_CONFIG_FILES([
+@@ -3075,6 +3086,10 @@ AC_CONFIG_FILES([
  	lib/dns/include/dns/Makefile
  	lib/dns/include/dst/Makefile
  	lib/dns/tests/Makefile
@@ -340,29 +361,19 @@ index 29106cb..3dff344 100644
  	lib/irs/Makefile
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
-@@ -3115,6 +3133,20 @@ AC_CONFIG_FILES([
- 	lib/isc/unix/include/Makefile
- 	lib/isc/unix/include/isc/Makefile
- 	lib/isc/unix/include/pkcs11/Makefile
-+	lib/isc-pkcs11/pthreads/Makefile
-+	lib/isc-pkcs11/pthreads/include/Makefile
-+	lib/isc-pkcs11/pthreads/include/isc/Makefile
-+	lib/isc-pkcs11/Makefile
-+	lib/isc-pkcs11/include/Makefile
-+	lib/isc-pkcs11/include/isc/Makefile
-+	lib/isc-pkcs11/include/isc/platform.h
-+	lib/isc-pkcs11/include/pk11/Makefile
-+	lib/isc-pkcs11/include/pkcs11/Makefile
-+	lib/isc-pkcs11/tests/Makefile
-+	lib/isc-pkcs11/unix/Makefile
-+	lib/isc-pkcs11/unix/include/Makefile
-+	lib/isc-pkcs11/unix/include/isc/Makefile
-+	lib/isc-pkcs11/unix/include/pkcs11/Makefile
- 	lib/isccc/Makefile
- 	lib/isccc/include/Makefile
- 	lib/isccc/include/isccc/Makefile
+@@ -3107,6 +3122,10 @@ AC_CONFIG_FILES([
+ 	lib/ns/include/Makefile
+ 	lib/ns/include/ns/Makefile
+ 	lib/ns/tests/Makefile
++	lib/ns-pkcs11/Makefile
++	lib/ns-pkcs11/include/Makefile
++	lib/ns-pkcs11/include/ns/Makefile
++	lib/ns-pkcs11/tests/Makefile
+ 	lib/samples/Makefile
+ 	lib/samples/Makefile-postinstall
+ 	unit/unittest.sh
 diff --git a/lib/Makefile.in b/lib/Makefile.in
-index ffa2d5a..439d748 100644
+index ffa2d5a..6fbc192 100644
 --- a/lib/Makefile.in
 +++ b/lib/Makefile.in
 @@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
@@ -370,36 +381,28 @@ index ffa2d5a..439d748 100644
  .NOTPARALLEL:
  .NO_PARALLEL:
 -SUBDIRS =	isc isccc dns ns isccfg bind9 irs samples
-+SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 ns isccfg bind9 irs samples
++SUBDIRS =	isc isccc dns dns-pkcs11 ns ns-pkcs11 isccfg bind9 irs samples
  TARGETS =
  
  @BIND9_MAKE_RULES@
 diff --git a/lib/dns-pkcs11/Makefile.in b/lib/dns-pkcs11/Makefile.in
-index 60c87a8..50da232 100644
+index 9125b10..593270d 100644
 --- a/lib/dns-pkcs11/Makefile.in
 +++ b/lib/dns-pkcs11/Makefile.in
-@@ -26,17 +26,17 @@ VERSION=@BIND9_VERSION@
+@@ -26,11 +26,11 @@ VERSION=@BIND9_VERSION@
  
  USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
  
 -CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
--		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
 +CINCLUDES =	-I. -I${top_srcdir}/lib/dns-pkcs11 -Iinclude ${DNS_PKCS11_INCLUDES} \
-+		${ISC_PKCS11_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
  		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
  
- CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO}
+-CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
++CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_PKCS11@ -DUSE_OPENSSL=0
  
  CWARNINGS =
  
--ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
- 
--ISCDEPLIBS =	../../lib/isc/libisc.@A@
-+ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
- 
- LIBS =		${MAXMINDDB_LIBS} @LIBS@
- 
 @@ -138,15 +138,15 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
@@ -420,13 +423,7 @@ index 60c87a8..50da232 100644
  
  include: gen
  	${MAKE} include/dns/enumtype.h
-@@ -172,27 +172,27 @@ code.h:	gen
- 	./gen -s ${srcdir} > code.h || { rm -f $@ ; exit 1; }
- 
- gen: gen.c
--	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc/include \
-+	${BUILD_CC} ${BUILD_CFLAGS} -I${top_srcdir}/lib/isc-pkcs11/include \
- 	${LFS_CFLAGS} ${LFS_LDFLAGS} \
+@@ -177,22 +177,22 @@ gen: gen.c
  	${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} -o $@ ${srcdir}/gen.c \
  	${BUILD_LIBS} ${LFS_LIBS}
  
@@ -454,100 +451,155 @@ index 60c87a8..50da232 100644
  	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
  	rm -f include/dns/rdatastruct.h
  	rm -f dnstap.pb-c.c dnstap.pb-c.h
-diff --git a/lib/isc-pkcs11/Makefile.in b/lib/isc-pkcs11/Makefile.in
-index ed87279..3171b48 100644
---- a/lib/isc-pkcs11/Makefile.in
-+++ b/lib/isc-pkcs11/Makefile.in
-@@ -20,7 +20,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES =	-I${srcdir}/unix/include \
- 		-I${srcdir}/pthreads/include \
- 		-I./include \
--		-I${srcdir}/include ${DNS_INCLUDES} @OPENSSL_INCLUDES@
-+		-I${srcdir}/include ${DNS_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
- CDEFINES =
+diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
+index 0e91523..9351c3f 100644
+--- a/lib/dns-pkcs11/tests/Makefile.in
++++ b/lib/dns-pkcs11/tests/Makefile.in
+@@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
++CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSDEPLIBS =	../libdns.@A@
++DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
++DNSDEPLIBS =	../libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
+diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
+index 9125b10..70644d8 100644
+--- a/lib/dns/Makefile.in
++++ b/lib/dns/Makefile.in
+@@ -30,7 +30,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/dns -Iinclude ${DNS_INCLUDES} \
+ 		${ISC_INCLUDES} ${MAXMINDDB_CFLAGS} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+-CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@ @USE_PKCS11@
++CDEFINES =	@USE_GSSAPI@ ${USE_ISC_SPNEGO} @USE_OPENSSL@
+ 
  CWARNINGS =
  
-@@ -94,40 +94,40 @@ version.@O@: version.c
+diff --git a/lib/ns-pkcs11/Makefile.in b/lib/ns-pkcs11/Makefile.in
+index 58d731a..47b4b98 100644
+--- a/lib/ns-pkcs11/Makefile.in
++++ b/lib/ns-pkcs11/Makefile.in
+@@ -20,8 +20,8 @@ VERSION=@BIND9_VERSION@
+ 
+ USE_ISC_SPNEGO = @USE_ISC_SPNEGO@
+ 
+-CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
+-		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -I${top_srcdir}/lib/ns-pkcs11 -Iinclude \
++		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+ CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
+@@ -32,9 +32,9 @@ ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ 
+ ISCDEPLIBS =	../../lib/isc/libisc.@A@
+ 
+-DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
++DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
+ 
+-DNSDEPLIBS =	../../lib/dns/libdns.@A@
++DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
+ 
+ LIBS =		@LIBS@
+ 
+@@ -66,28 +66,28 @@ version.@O@: version.c
  		-DLIBAGE=${LIBAGE} \
  		-c ${srcdir}/version.c
  
--libisc.@SA@: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.@SA@: ${OBJS} ${SYMTBLOBJS}
- 	${AR} ${ARFLAGS} $@ ${OBJS} ${SYMTBLOBJS}
- 	${RANLIB} $@
- 
--libisc-nosymtbl.@SA@: ${OBJS}
-+libisc-pkcs11-nosymtbl.@SA@: ${OBJS}
+-libns.@SA@: ${OBJS}
++libns-pkcs11.@SA@: ${OBJS}
  	${AR} ${ARFLAGS} $@ ${OBJS}
  	${RANLIB} $@
  
--libisc.la: ${OBJS} ${SYMTBLOBJS}
-+libisc-pkcs11.la: ${OBJS} ${SYMTBLOBJS}
+-libns.la: ${OBJS}
++libns-pkcs11.la: ${OBJS}
  	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11.la -rpath ${libdir} \
+-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns.la -rpath ${libdir} \
++		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libns-pkcs11.la -rpath ${libdir} \
  		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${SYMTBLOBJS} ${LIBS}
- 
--libisc-nosymtbl.la: ${OBJS}
-+libisc-pkcs11-nosymtbl.la: ${OBJS}
- 	${LIBTOOL_MODE_LINK} \
--		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
-+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-pkcs11-nosymtbl.la -rpath ${libdir} \
- 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
- 		${OBJS} ${LIBS}
+-		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
++		${OBJS} ${ISCLIBS} @DNS_CRYPTO_PK11_LIBS@ ${LIBS}
  
--timestamp: libisc.@A@ libisc-nosymtbl.@A@
-+timestamp: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
+-timestamp: libns.@A@
++timestamp: libns-pkcs11.@A@
  	touch timestamp
  
--testdirs: libisc.@A@ libisc-nosymtbl.@A@
-+testdirs: libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@
- 
  installdirs:
  	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir}
  
  install:: timestamp installdirs
--	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc.@A@ ${DESTDIR}${libdir}
-+	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libisc-pkcs11.@A@ ${DESTDIR}${libdir}
+-	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns.@A@ \
++	${LIBTOOL_MODE_INSTALL} ${INSTALL_LIBRARY} libns-pkcs11.@A@ \
+ 		${DESTDIR}${libdir}
  
  uninstall::
--	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc.@A@
-+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libisc-pkcs11.@A@
+-	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@
++	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns-pkcs11.@A@
  
  clean distclean::
--	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
--	libisc-nosymtbl.la timestamp
-+	rm -f libisc-pkcs11.@A@ libisc-pkcs11-nosymtbl.@A@ libisc-pkcs11.la \
-+	libisc-pkcs11-nosymtbl.la timestamp
-diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 5735829..7e62737 100644
---- a/lib/isc-pkcs11/tests/Makefile.in
-+++ b/lib/isc-pkcs11/tests/Makefile.in
-@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
- CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
- CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
- 
--ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../libisc-pkcs11.@A@ @OPENSSL_LIBS@
- ISCDEPLIBS =	../libisc.@A@
+-	rm -f libns.@A@ timestamp
++	rm -f libns-pkcs11.@A@ timestamp
+diff --git a/lib/ns-pkcs11/tests/Makefile.in b/lib/ns-pkcs11/tests/Makefile.in
+index ffd8f41..4a6cb1b 100644
+--- a/lib/ns-pkcs11/tests/Makefile.in
++++ b/lib/ns-pkcs11/tests/Makefile.in
+@@ -15,16 +15,16 @@ VERSION=@BIND9_VERSION@
+ 
+ @BIND9_MAKE_INCLUDES@
+ 
+-CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
++CINCLUDES =	-I. -Iinclude ${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
+-CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	@USE_PKCS11@ -DTESTS="\"${top_builddir}/lib/ns/tests/\"" -DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
+ ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
+ ISCDEPLIBS =	../../isc/libisc.@A@
+-DNSLIBS =	../../dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
+-DNSDEPLIBS =	../../dns/libdns.@A@
+-NSLIBS =	../libns.@A@
+-NSDEPLIBS =	../libns.@A@
++DNSLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_PK11_LIBS@
++DNSDEPLIBS =	../../dns-pkcs11/libdns-pkcs11.@A@
++NSLIBS =	../libns-pkcs11.@A@
++NSDEPLIBS =	../libns-pkcs11.@A@
  
  LIBS =		@LIBS@ @CMOCKA_LIBS@
+ 
+diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in
+index 58d731a..a14728d 100644
+--- a/lib/ns/Makefile.in
++++ b/lib/ns/Makefile.in
+@@ -24,7 +24,7 @@ CINCLUDES =	-I. -I${top_srcdir}/lib/ns -Iinclude \
+ 		${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
+ 		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+ 
+-CDEFINES =	@USE_PKCS11@ -DNAMED_PLUGINDIR=\"${plugindir}\"
++CDEFINES =	-DNAMED_PLUGINDIR=\"${plugindir}\"
+ 
+ CWARNINGS =
+ 
 diff --git a/make/includes.in b/make/includes.in
-index 48cdaf7..6e6572b 100644
+index 48cdaf7..7b17738 100644
 --- a/make/includes.in
 +++ b/make/includes.in
-@@ -39,3 +39,16 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
+@@ -39,3 +39,10 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
  
  TEST_INCLUDES = \
  	-I${top_srcdir}/lib/tests/include
 +
-+ISC_PKCS11_INCLUDES = @BIND9_ISC_PKCS11_BUILDINCLUDE@ \
-+	-I${top_srcdir}/lib/isc-pkcs11 \
-+	-I${top_srcdir}/lib/isc-pkcs11/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
-+	-I${top_srcdir}/lib/isc-pkcs11/pthreads/include
-+
 +DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
 +	-I${top_srcdir}/lib/dns-pkcs11/include
 +
diff --git a/bind-9.11-kyua-pkcs11.patch b/bind-9.11-kyua-pkcs11.patch
index 95e9843..ea9a51a 100644
--- a/bind-9.11-kyua-pkcs11.patch
+++ b/bind-9.11-kyua-pkcs11.patch
@@ -1,4 +1,4 @@
-From f0ce2b4855b70f1fb04394b35626c37ebb0a8c75 Mon Sep 17 00:00:00 2001
+From 1241f2005d08673c28a595c5a6cd61350b95a929 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 2 Jan 2018 18:13:07 +0100
 Subject: [PATCH] Fix pkcs11 variants atf tests
@@ -7,18 +7,16 @@ Add dns-pkcs11 tests Makefile to configure
 
 Add pkcs11 Kyuafile, fix dh_test to pass in pkcs11 mode
 ---
- configure.ac                     |  1 +
- lib/Kyuafile                     |  2 ++
- lib/dns-pkcs11/tests/Makefile.in | 12 ++++++------
- lib/dns-pkcs11/tests/dh_test.c   |  3 ++-
- lib/isc-pkcs11/tests/Makefile.in |  6 +++---
- 5 files changed, 14 insertions(+), 10 deletions(-)
+ configure.ac                   | 1 +
+ lib/Kyuafile                   | 2 ++
+ lib/dns-pkcs11/tests/dh_test.c | 3 ++-
+ 3 files changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/configure.ac b/configure.ac
-index 3dff344..424a542 100644
+index d80ae31..0fb9328 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3113,6 +3113,7 @@ AC_CONFIG_FILES([
+@@ -3090,6 +3090,7 @@ AC_CONFIG_FILES([
  	lib/dns-pkcs11/include/Makefile
  	lib/dns-pkcs11/include/dns/Makefile
  	lib/dns-pkcs11/include/dst/Makefile
@@ -27,7 +25,7 @@ index 3dff344..424a542 100644
  	lib/irs/include/Makefile
  	lib/irs/include/irs/Makefile
 diff --git a/lib/Kyuafile b/lib/Kyuafile
-index 39ce986..dcfb139 100644
+index 39ce986..037e5ef 100644
 --- a/lib/Kyuafile
 +++ b/lib/Kyuafile
 @@ -2,8 +2,10 @@ syntax(2)
@@ -37,40 +35,15 @@ index 39ce986..dcfb139 100644
 +include('dns-pkcs11/Kyuafile')
  include('irs/Kyuafile')
  include('isc/Kyuafile')
-+include('isc-pkcs11/Kyuafile')
  include('isccc/Kyuafile')
  include('isccfg/Kyuafile')
  include('ns/Kyuafile')
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index eb297c9..144d6b2 100644
---- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -15,14 +15,14 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
-+CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
--CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
- 
--ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
--ISCDEPLIBS =	../../isc/libisc.@A@
--DNSLIBS =	../libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--DNSDEPLIBS =	../libdns.@A@
-+ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-+DNSDEPLIBS =	../libdns-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
++include('ns-pkcs11/Kyuafile')
 diff --git a/lib/dns-pkcs11/tests/dh_test.c b/lib/dns-pkcs11/tests/dh_test.c
-index d83d9f5..d5bda29 100644
+index 934e8fd..658d1af 100644
 --- a/lib/dns-pkcs11/tests/dh_test.c
 +++ b/lib/dns-pkcs11/tests/dh_test.c
-@@ -85,7 +85,8 @@ dh_computesecret(void **state) {
+@@ -87,7 +87,8 @@ dh_computesecret(void **state) {
  	result = dst_key_computesecret(key, key, &buf);
  	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
  	result = key->func->computesecret(key, key, &buf);
@@ -80,25 +53,6 @@ index d83d9f5..d5bda29 100644
  
  	dst_key_free(&key);
  }
-diff --git a/lib/isc-pkcs11/tests/Makefile.in b/lib/isc-pkcs11/tests/Makefile.in
-index 7e62737..e91cd67 100644
---- a/lib/isc-pkcs11/tests/Makefile.in
-+++ b/lib/isc-pkcs11/tests/Makefile.in
-@@ -15,11 +15,11 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
--CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
-+CINCLUDES =	-I. -Iinclude ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
-+CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc-pkcs11/tests/\""
- 
- ISCLIBS =	../libisc-pkcs11.@A@ @OPENSSL_LIBS@
--ISCDEPLIBS =	../libisc.@A@
-+ISCDEPLIBS =	../libisc-pkcs11.@A@
- 
- LIBS =		@LIBS@ @CMOCKA_LIBS@
- 
 -- 
 2.20.1
 
diff --git a/bind-9.14-config-pkcs11.patch b/bind-9.14-config-pkcs11.patch
index 4559fe5..cf73a1c 100644
--- a/bind-9.14-config-pkcs11.patch
+++ b/bind-9.14-config-pkcs11.patch
@@ -1,4 +1,4 @@
-From 0427e970f0294cadf4dff04021f41e751c713e3c Mon Sep 17 00:00:00 2001
+From 233d3784d04bee37b772f391da8726f0cd7b223e Mon Sep 17 00:00:00 2001
 From: Petr Mensik <pemensik@redhat.com>
 Date: Fri, 18 Oct 2019 21:30:52 +0200
 Subject: [PATCH] Move USE_PKCS11 and USE_OPENSSL out of config.h
@@ -7,14 +7,15 @@ Building two variants with the same common code requires to unset
 USE_PKCS11 on part of build. That is not possible with config.h value.
 Move it as normal define to CDEFINES.
 ---
- bin/confgen/Makefile.in | 2 +-
- bin/dig/Makefile.in     | 2 +-
- bin/dnssec/Makefile.in  | 2 +-
- bin/named/Makefile.in   | 2 +-
- configure.ac            | 8 ++++++--
- lib/dns/Makefile.in     | 2 +-
- lib/ns/Makefile.in      | 2 +-
- 7 files changed, 12 insertions(+), 8 deletions(-)
+ bin/confgen/Makefile.in |  2 +-
+ bin/dig/Makefile.in     |  2 +-
+ bin/dnssec/Makefile.in  |  2 +-
+ bin/named/Makefile.in   |  2 +-
+ configure.ac            |  8 ++++++--
+ lib/dns/Makefile.in     |  2 +-
+ lib/dns/dst_internal.h  | 12 +++++++++---
+ lib/ns/Makefile.in      |  2 +-
+ 8 files changed, 21 insertions(+), 11 deletions(-)
 
 diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
 index dc3a7f6..1e0fe0e 100644
@@ -69,20 +70,20 @@ index eecfa76..e5b0d4b 100644
  CWARNINGS =
  
 diff --git a/configure.ac b/configure.ac
-index da6de97..6d4cdcc 100644
+index 80039b7..6cce3bb 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -963,9 +963,13 @@ AS_CASE([$enable_native_pkcs11],
  AC_SUBST([PKCS11_TEST])
  AC_SUBST([PKCS11_TOOLS])
  
-+USE_PKCS11=
-+USE_OPENSSL=
++USE_PKCS11='-DUSE_PKCS11=0'
++USE_OPENSSL='-DUSE_OPENSSL=0'
  AS_CASE([$CRYPTO],
 -	[pkcs11],[AC_DEFINE([USE_PKCS11], [1], [define if PKCS11 is used for Public-Key Cryptography])],
 -	[AC_DEFINE([USE_OPENSSL], [1], [define if OpenSSL is used for Public-Key Cryptography])])
-+	[pkcs11],[USE_PKCS11='-DUSE_PKCS11'],
-+	[USE_OPENSSL='-DUSE_OPENSSL'])
++	[pkcs11],[USE_PKCS11='-DUSE_PKCS11=1'],
++	[USE_OPENSSL='-DUSE_OPENSSL=1'])
 +AC_SUBST(USE_PKCS11)
 +AC_SUBST(USE_OPENSSL)
  
@@ -101,6 +102,38 @@ index 60c87a8..9125b10 100644
  
  CWARNINGS =
  
+diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
+index bfa28f0..d3ff613 100644
+--- a/lib/dns/dst_internal.h
++++ b/lib/dns/dst_internal.h
+@@ -40,6 +40,13 @@
+ #include <isc/stdtime.h>
+ #include <isc/hmac.h>
+ 
++#ifndef USE_OPENSSL
++#define USE_OPENSSL 1
++#endif
++#ifndef USE_PKCS11
++#define USE_PKCS11 0
++#endif
++
+ #if USE_PKCS11
+ #include <pk11/pk11.h>
+ #include <pk11/site.h>
+@@ -99,11 +106,10 @@ struct dst_key {
+ 		void *generic;
+ 		gss_ctx_id_t gssctx;
+ 		DH *dh;
+-#if USE_OPENSSL
+-		EVP_PKEY *pkey;
+-#endif
+ #if USE_PKCS11
+ 		pk11_object_t *pkey;
++#else
++		EVP_PKEY *pkey;
+ #endif
+ 		dst_hmac_key_t *hmac_key;
+ 	} keydata;			/*%< pointer to key in crypto pkg fmt */
 diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in
 index a14728d..58d731a 100644
 --- a/lib/ns/Makefile.in
diff --git a/bind-9.14-disable-isc-pkcs11.patch b/bind-9.14-disable-isc-pkcs11.patch
deleted file mode 100644
index b8ee475..0000000
--- a/bind-9.14-disable-isc-pkcs11.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From f354e06035a6661b29f665890933c9d0108cd3e5 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 18 Oct 2019 21:55:19 +0200
-Subject: [PATCH] Do not define ISC_PKCS11_INCLUDES
-
-isc library is no longer different. Just dns library is different.
-Do not try to use isc-pkcs11 library for no reason.
----
- bin/dnssec-pkcs11/Makefile.in    |  8 ++++----
- bin/named-pkcs11/Makefile.in     | 10 +++++-----
- bin/pkcs11/Makefile.in           |  6 +++---
- configure.ac                     | 15 ---------------
- lib/Makefile.in                  |  2 +-
- lib/dns-pkcs11/tests/Makefile.in |  4 ++--
- make/includes.in                 |  6 ------
- 7 files changed, 15 insertions(+), 36 deletions(-)
-
-diff --git a/bin/dnssec-pkcs11/Makefile.in b/bin/dnssec-pkcs11/Makefile.in
-index 5067ee1..54b9f10 100644
---- a/bin/dnssec-pkcs11/Makefile.in
-+++ b/bin/dnssec-pkcs11/Makefile.in
-@@ -15,17 +15,17 @@ VERSION=@BIND9_VERSION@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} @OPENSSL_INCLUDES@
-+CINCLUDES =	${DNS_PKCS11_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
- 
- CDEFINES =	-DVERSION=\"${VERSION}\"
- CWARNINGS =
- 
- DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
--ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
- 
- DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
--ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc/libisc.@A@
- 
- DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
- 
-diff --git a/bin/named-pkcs11/Makefile.in b/bin/named-pkcs11/Makefile.in
-index 416e12e..a0e8314 100644
---- a/bin/named-pkcs11/Makefile.in
-+++ b/bin/named-pkcs11/Makefile.in
-@@ -43,9 +43,9 @@ DLZDRIVER_INCLUDES =	@DLZ_DRIVER_INCLUDES@
- DLZDRIVER_LIBS =	@DLZ_DRIVER_LIBS@
- 
- CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
--		${NS_INCLUDES} ${DNS_PKCS11_INCLUDES} \
-+		${NS_PKCS11_INCLUDES} ${DNS_PKCS11_INCLUDES} \
- 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
--		${ISC_PKCS11_INCLUDES} ${DLZDRIVER_INCLUDES} \
-+		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
- 		${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
- 		@OPENSSL_INCLUDES@
- 
-@@ -56,15 +56,15 @@ CWARNINGS =
- DNSLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
- ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCLIBS =	../../lib/isccc/libisccc.@A@
--ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
--ISCNOSYMLIBS =	../../lib/isc-pkcs11/libisc-pkcs11-nosymtbl.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
-+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
- BIND9LIBS =	../../lib/bind9/libbind9.@A@
- NSLIBS =	../../lib/ns/libns.@A@
- 
- DNSDEPLIBS =	../../lib/dns-pkcs11/libdns-pkcs11.@A@
- ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
- ISCCCDEPLIBS =	../../lib/isccc/libisccc.@A@
--ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc/libisc.@A@
- BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
- NSDEPLIBS =	../../lib/ns/libns.@A@
- 
-diff --git a/bin/pkcs11/Makefile.in b/bin/pkcs11/Makefile.in
-index 0e542f3..96aec05 100644
---- a/bin/pkcs11/Makefile.in
-+++ b/bin/pkcs11/Makefile.in
-@@ -13,13 +13,13 @@ top_srcdir =	@top_srcdir@
- 
- @BIND9_MAKE_INCLUDES@
- 
--CINCLUDES =	${ISC_PKCS11_INCLUDES}
-+CINCLUDES =	${ISC_INCLUDES}
- 
- CDEFINES =
- 
--ISCLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@ @OPENSSL_LIBS@
-+ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
- 
--ISCDEPLIBS =	../../lib/isc-pkcs11/libisc-pkcs11.@A@
-+ISCDEPLIBS =	../../lib/isc/libisc.@A@
- 
- DEPLIBS =	${ISCDEPLIBS}
- 
-diff --git a/configure.ac b/configure.ac
-index 6d4cdcc..39c1d95 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -2535,7 +2535,6 @@ if test "X$srcdir" != "X"; then
- 	BIND9_NS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns/include"
- 	BIND9_BIND9_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/bind9/include"
- 	BIND9_IRS_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/irs/include"
--	BIND9_ISC_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/isc-pkcs11/include"
- 	BIND9_DNS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/dns-pkcs11/include"
- 	BIND9_NS_PKCS11_BUILDINCLUDE="-I${BIND9_TOP_BUILDDIR}/lib/ns-pkcs11/include"
- else
-@@ -3114,20 +3113,6 @@ AC_CONFIG_FILES([
- 	lib/isc/unix/include/Makefile
- 	lib/isc/unix/include/isc/Makefile
- 	lib/isc/unix/include/pkcs11/Makefile
--	lib/isc-pkcs11/pthreads/Makefile
--	lib/isc-pkcs11/pthreads/include/Makefile
--	lib/isc-pkcs11/pthreads/include/isc/Makefile
--	lib/isc-pkcs11/Makefile
--	lib/isc-pkcs11/include/Makefile
--	lib/isc-pkcs11/include/isc/Makefile
--	lib/isc-pkcs11/include/isc/platform.h
--	lib/isc-pkcs11/include/pk11/Makefile
--	lib/isc-pkcs11/include/pkcs11/Makefile
--	lib/isc-pkcs11/tests/Makefile
--	lib/isc-pkcs11/unix/Makefile
--	lib/isc-pkcs11/unix/include/Makefile
--	lib/isc-pkcs11/unix/include/isc/Makefile
--	lib/isc-pkcs11/unix/include/pkcs11/Makefile
- 	lib/isccc/Makefile
- 	lib/isccc/include/Makefile
- 	lib/isccc/include/isccc/Makefile
-diff --git a/lib/Makefile.in b/lib/Makefile.in
-index 439d748..3f655e8 100644
---- a/lib/Makefile.in
-+++ b/lib/Makefile.in
-@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@
- # Attempt to disable parallel processing.
- .NOTPARALLEL:
- .NO_PARALLEL:
--SUBDIRS =	isc isc-pkcs11 isccc dns dns-pkcs11 ns isccfg bind9 irs samples
-+SUBDIRS =	isc isccc dns dns-pkcs11 ns isccfg bind9 irs samples
- TARGETS =
- 
- @BIND9_MAKE_RULES@
-diff --git a/lib/dns-pkcs11/tests/Makefile.in b/lib/dns-pkcs11/tests/Makefile.in
-index 9f78596..ac187c9 100644
---- a/lib/dns-pkcs11/tests/Makefile.in
-+++ b/lib/dns-pkcs11/tests/Makefile.in
-@@ -19,8 +19,8 @@ CINCLUDES =	-I. -Iinclude ${DNS_PKCS11_INCLUDES} ${ISC_PKCS11_INCLUDES} \
- 		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
- CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns-pkcs11/tests/\""
- 
--ISCLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
--ISCDEPLIBS =	../../isc-pkcs11/libisc-pkcs11.@A@
-+ISCLIBS =	../../isc/libisc.@A@
-+ISCDEPLIBS =	../../isc/libisc.@A@
- DNSLIBS =	../libdns-pkcs11.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
- DNSDEPLIBS =	../libdns-pkcs11.@A@
- 
-diff --git a/make/includes.in b/make/includes.in
-index 6e6572b..7b17738 100644
---- a/make/includes.in
-+++ b/make/includes.in
-@@ -40,12 +40,6 @@ BIND9_INCLUDES = @BIND9_BIND9_BUILDINCLUDE@ \
- TEST_INCLUDES = \
- 	-I${top_srcdir}/lib/tests/include
- 
--ISC_PKCS11_INCLUDES = @BIND9_ISC_PKCS11_BUILDINCLUDE@ \
--	-I${top_srcdir}/lib/isc-pkcs11 \
--	-I${top_srcdir}/lib/isc-pkcs11/include \
--	-I${top_srcdir}/lib/isc-pkcs11/unix/include \
--	-I${top_srcdir}/lib/isc-pkcs11/pthreads/include
--
- DNS_PKCS11_INCLUDES = @BIND9_DNS_PKCS11_BUILDINCLUDE@ \
- 	-I${top_srcdir}/lib/dns-pkcs11/include
- 
--- 
-2.20.1
-
diff --git a/bind.spec b/bind.spec
index df6cc92..538202b 100644
--- a/bind.spec
+++ b/bind.spec
@@ -131,8 +131,6 @@ Patch135:bind-9.14-config-pkcs11.patch
 # Fedora specific patch to distribute native-pkcs#11 functionality
 Patch136:bind-9.10-dist-native-pkcs11.patch
 # Do not use isc-pkcs11.
-# FIXME: should be part of Patch136
-Patch138:bind-9.14-disable-isc-pkcs11.patch
 Patch149:bind-9.11-kyua-pkcs11.patch
 
 # [ISC-Bugs #42525] non-portable use of strlcat in contrib/sdb/ldap/zone2ldap.c
@@ -588,10 +586,9 @@ are used for building ISC DHCP.
 %patch135 -p1 -b .config-pkcs11
 cp -r bin/named{,-pkcs11}
 cp -r bin/dnssec{,-pkcs11}
-cp -r lib/isc{,-pkcs11}
 cp -r lib/dns{,-pkcs11}
+cp -r lib/ns{,-pkcs11}
 %patch136 -p1 -b .dist_pkcs11
-%patch138 -p1 -b .no-isc-pkcs11
 %patch149 -p1 -b .kyua-pkcs11
 %patch150 -p1 -b .engine-pkcs11
 %endif