I'm configuring BIND9 to obtain a wildcard certificate from Let's Encrypt. When I try to generate TSIG key according to instruction here, I got the following error:

# dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST keyname.
dnssec-keygen: fatal: unknown algorithm HMAC-SHA512

Then I read help and document about dnssec-keygen, there is no algorithm called HMAC-SHA512 indeed:

# dnssec-keygen -h
    dnssec-keygen [options] name

Version: 9.14.2
    name: owner of the key
    -K <directory>: write keys into directory
    -a <algorithm>:
        RSASHA1 | NSEC3RSASHA1 |
        RSASHA256 | RSASHA512 |
        ECDSAP256SHA256 | ECDSAP384SHA384 |
        ED25519 | ED448 | DH
    -3: use NSEC3-capable algorithm
    -b <key size in bits>:
        RSASHA1:        [1024..4096]
        NSEC3RSASHA1:   [1024..4096]
        RSASHA256:      [1024..4096]
        RSASHA512:      [1024..4096]
        DH:             [128..4096]
        ECDSAP256SHA256:        ignored
        ECDSAP384SHA384:        ignored
        ED25519:        ignored
        ED448:  ignored
        (key size defaults are set according to
        algorithm and usage (ZSK or KSK)
    -n <nametype>: ZONE | HOST | ENTITY | USER | OTHER
        (DNSKEY generation defaults to ZONE)
    -c <class>: (default: IN)
    -d <digest bits> (0 => max, default)
    -E <engine>:
        name of an OpenSSL engine to use
    -f <keyflag>: KSK | REVOKE
    -g <generator>: use specified generator (DH only)
    -L <ttl>: default key TTL
    -p <protocol>: (default: 3 [dnssec])
    -s <strength>: strength value this key signs DNS records with (default: 0)
    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; use KEY for SIG(0))
    -h: print usage and exit
    -m <memory debugging mode>:
       usage | trace | record | size | mctx
    -v <level>: set verbosity level (0 - 10)
    -V: print version information
Timing options:
    -P date/[+-]offset/none: set key publication date (default: now)
    -P sync date/[+-]offset/none: set CDS and CDNSKEY publication date
    -A date/[+-]offset/none: set key activation date (default: now)
    -R date/[+-]offset/none: set key revocation date
    -I date/[+-]offset/none: set key inactivation date
    -D date/[+-]offset/none: set key deletion date
    -D sync date/[+-]offset/none: set CDS and CDNSKEY deletion date
    -G: generate key only; do not set -P or -A
    -C: generate a backward-compatible key, omitting all dates
    -S <key>: generate a successor to an existing key
    -i <interval>: prepublication interval for successor key (default: 30 days)
     K<name>+<alg>+<id>.key, K<name>+<alg>+<id>.private

I dug into another question: can't generate key via dnssec-keygen, but my problem remains unsolved.

What should I do?

  • Mobile here, can't verify much this for a few hours. What relation has got let's encript with DNSSEC? Up voted both the question and answer. Jun 7, 2019 at 15:56
  • 1
    @RuiFRibeiro Let's Encrypt implemented a feature allow user to obtain wildcard certificate, to do that you need a Certbot plugin called 'certbot-dns-rfc2136'. Hence DNSSEC is involved. The document of plugin here demonstrates a sample BIND9 configuration, to limits the scope of the TSIG key to just be able to add and remove TXT records for one specific host for the purpose of completing the dns-01 challenge. Jun 7, 2019 at 16:23
  • However it doesn't work for the newest version of BIND9 which I built in Docker. I guess the writer of this document only has BIND 9.10.3-P4-Debian (installed with apt-get) around. :) Jun 7, 2019 at 16:24

1 Answer 1


After a bit searching, I found the document of plugin certbot-dns-rfc2136 is obsolete!

In BIND9's official git repository, I found the following commit message:

  1. [func] The use of dnssec-keygen to generate HMAC keys is deprecated in favor of tsig-keygen. dnssec-keygen will print a warning when used for this purpose. All HMAC algorithms will be removed from dnssec-keygen in a future release. [RT #42272]

So, the final solution is:

tsig-keygen -a hmac-sha512 tsig-key > /etc/bind/tsig.key

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.