Commit 62b563d6a0 for bind
commit 62b563d6a0c0a11d37a78c2b2bdc730860941ffe
Author: Aydın Mercan <aydin@isc.org>
Date: Thu Sep 24 12:44:36 2026 +0300
Remove the SoftHSMv2 section from the PKCS#11 documentation
SoftHSMv2 is no longer what BIND is tested against and should not be
relied on for PKCS#11 in production. The pkcs11-provider section that
follows covers what matters for using an HSM with BIND.
diff --git a/doc/arm/pkcs11.inc.rst b/doc/arm/pkcs11.inc.rst
index d1b3d7c7bd..a38bb6054b 100644
--- a/doc/arm/pkcs11.inc.rst
+++ b/doc/arm/pkcs11.inc.rst
@@ -38,33 +38,6 @@ Prerequisites
See the documentation provided by the HSM vendor for information about
installing, initializing, testing, and troubleshooting the HSM.
-Building SoftHSMv2
-^^^^^^^^^^^^^^^^^^
-
-SoftHSMv2, the latest development version of SoftHSM, is available from
-https://github.com/softhsm/SoftHSMv2. It is a software library
-developed by the OpenDNSSEC project (https://www.opendnssec.org) which
-provides a PKCS#11 interface to a virtual HSM, implemented in the form
-of an SQLite3 database on the local filesystem. It provides less security
-than a true HSM, but it allows users to experiment with native PKCS#11
-when an HSM is not available. SoftHSMv2 can be configured to use either
-OpenSSL or the Botan library to perform cryptographic functions, but
-when using it for native PKCS#11 in BIND, OpenSSL is required.
-
-By default, the SoftHSMv2 configuration file is ``prefix/etc/softhsm2.conf``
-(where ``prefix`` is configured at compile time). This location can be
-overridden by the SOFTHSM2_CONF environment variable. The SoftHSMv2
-cryptographic store must be installed and initialized before using it
-with BIND.
-
-::
-
- $ cd SoftHSMv2
- $ configure --with-crypto-backend=openssl --prefix=/opt/pkcs11/usr
- $ make
- $ make install
- $ /opt/pkcs11/usr/bin/softhsm-util --init-token 0 --slot 0 --label softhsmv2
-
OpenSSL 3 With pkcs11-provider
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^