diff --git a/Sanity/utils/pkcs11-tools/runtest.sh b/Sanity/utils/pkcs11-tools/runtest.sh
index 737f6e2..98e4251 100755
--- a/Sanity/utils/pkcs11-tools/runtest.sh
+++ b/Sanity/utils/pkcs11-tools/runtest.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k expandtab sts=4
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
 #   runtest.sh of /CoreOS/bind/Sanity/delv-smoke-test
@@ -31,73 +31,110 @@
 : ${PACKAGE:=bind}
 BACKUP_RESOLV=""
 SOURCE_RESOLV="/etc/resolv.conf"
+: ${ENGINE:=-E pkcs11}
+
+make_openssl_conf() {
+	cat << EOF
+HOME = .
+
+# Use this in order to automatically load providers.
+openssl_conf = openssl_init
+
+[openssl_init]
+providers = provider_sect
+
+[provider_sect]
+default = default_sect
+pkcs11 = pkcs11_sect
+
+[default_sect]
+activate = 1
+
+[pkcs11_sect]
+module = ${PROVIDER_MODULE}
+pkcs11-module-path = ${SOFTHSM2_MODULE}
+pkcs11-module-token-pin = ${PIN_SOURCE}
+activate = 1
+EOF
+}
+
+make_localhost_zone() {
+        cat << 'EOF'
+$TTL 10m
+@	IN SOA	@ rname.invalid. (
+					0	; serial
+					1D	; refresh
+					1H	; retry
+					1W	; expire
+					3H )	; minimum
+	NS	@
+	A	127.0.0.1
+	AAAA	::1
+
+EOF
+}
+
+pkcs11_tool_object_uri() {
+    awk '"uri:" == $1 { print $2 }'
+}
 
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm $PACKAGE-utils
-	rlRun "REAL_RESOLV=$(realpath /etc/resolv.conf)"
-	rlRun "BACKUP_RESOLV=$(mktemp /etc/resolv-XXXXXX.conf)"
-	rlRun "rm -f $BACKUP_RESOLV"
-	rlRun -l "hostnamectl" 0-255 "Record type of used machine"
-	if [ "$REAL_RESOLV" = /run/systemd/resolve/stub-resolv.conf ]; then
-		rlWarning "systemd-resolved stub detected, temporary switching..."
-		rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
-		SOURCE_RESOLV="/run/systemd/resolve/resolv.conf"
-	else
-		rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
-		SOURCE_RESOLV="$BACKUP_RESOLV"
+
+	TmpDir="$(mktemp -d)"
+	SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
+	SOFTHSM2_MODULE="$(rpm -E '%{_libdir}/pkcs11/libsofthsm2.so')"
+	PROVIDER_MODULE="$(rpm -E '%{_libdir}/ossl-modules/pkcs11.so')"
+	# Used by OpenSSL
+	PKCS11_PROVIDER_MODULE="$SOFTHSM2_MODULE"
+	export PKCS11_PROVIDER_MODULE PROVIDER_MODULE
+	export PKCS11_PROVIDER_DEBUG=file:$TmpDir/provider-debug.log,level:2
+
+	if [ -x "$SOFTHSM2_MODULE" ]; then
+		export SOFTHSM2_MODULE
 	fi
-	rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
-	rlRun -l "cat /etc/resolv.conf"
-	DNSSEC=""
-	for NS in $(awk '$1 == "nameserver" { print $2 }' /etc/resolv.conf)
-	do
-		if dig +dnssec @$NS | grep -q RRSIG; then
-			rlLog "nameserver $NS supports DNSSEC"
-			DNSSEC=yes
-		else
-			rlLogWarning "nameserver $NS does not support DNSSEC!"
-			rlRun -l "dig +short @$NS -t txt -c ch -q version.bind" 0 "Query version of server $NS"
-			rlRun "sed -e '/$NS/ d' -i /etc/resolv.conf"
-		fi
-		rlRun -c "dig @$NS | grep -w RRSIG" 1 "Check signatures are not present always on $NS"
-	done
-	if [ -z "$DNSSEC" ]; then
-		DNSSEC=no
-		rlLogWarning "Infrastructure does not support DNSSEC at all!"
-		rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
-	fi
-	rlRun -l "cat /etc/resolv.conf" 0 "after modifications"
+
+        rlRun "softhsm2-util --show-slots | grep 'Initialized: *yes'" 1 "Check no slot is initialized already"
+	rlRun "eval $(bash $SETUP_SOFTHSM -A)" 0 "Preparing PKCS#11 token slot"
+	rlLog "Vars: conf=$SOFTHSM2_CONF pin=$PIN_SOURCE sopin=$SOPIN_SOURCE"
+
+	rlRun "pushd $TmpDir"
+	rlRun "make_openssl_conf | tee openssl.conf" 0 "Make provider enabled OpenSSL configuration"
+        rlRun "make_localhost_zone > test.zone" 0 "Create test zone"
+	export OPENSSL_CONF="$TmpDir/openssl.conf"
+        rlLog "OPENSSL_CONF=$TmpDir/openssl.conf"
     rlPhaseEnd
 
-    rlPhaseStartTest
-	rlRun -l -s "delv redhat.com"
-	rlAssertGrep 'IN' $rlRun_LOG
-	rlRun -s "delv redhat.com soa +multi"
-	rlAssertGrep 'serial' $rlRun_LOG
-	rlRun -s "delv +multi +vtrace"
-	rlRun "LINES=$(wc -l <$rlRun_LOG)"
-	rlRun -l "cat $rlRun_LOG"
-	rlAssertGreater "delv +vtrace should show few lines" "$LINES" "10"
-	rlRun "delv +vtrace | grep 'fully validated'"
-	if [ "$DNSSEC" = yes ]; then
-		rlRun -s "delv"
-		rlAssertGrep 'fully validated' $rlRun_LOG
-		rlRun -s "delv example.net"
-		rlAssertGrep 'fully validated' $rlRun_LOG
-		rlRun -s "delv +vtrace fedoraproject.org"
-		rlAssertGrep 'fully validated' $rlRun_LOG
-		rlAssertGrep 'marking as secure' $rlRun_LOG
+    rlPhaseStartSetup "Prepare token"
+	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -L" 0 "check slots"
+	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -T" 0 "check tokens"
+	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:2048 --label test-zsk" 0 "generate new pair"
+	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:4096 --label test-ksk" 0 "generate new pair"
+	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -O" 0 "check objects saved"
+	rlRun "ZSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN -O --label test-zsk --type privkey | pkcs11_tool_object_uri)" 0 "Obtain slot zsk URI"
+	rlRun "KSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN -O --label test-ksk --type privkey | pkcs11_tool_object_uri)" 0 "Obtain slot ksk URI"
+	rlRun "test -n \"$ZSK_URI\"" 0 "Check URI were obtained"
+	rlRun "test -n \"$KSK_URI\"" 0 "Check URI were obtained"
+	rlRun "openssl pkey -in '$ZSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public ZSK key"
+	rlRun "openssl pkey -in '$KSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public KSK key"
+    rlPhaseEnd
 
-	fi
+    rlPhaseStartTest "Test DNSSEC operations on token"
+	rlRun "dnssec-keyfromlabel -a RSASHA256 $ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
+	rlRun "dnssec-keyfromlabel -a RSASHA256 $ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"
+        rlRun "dnssec-signzone $ENGINE -S -o test test.zone" 0 "Create zone signatures"
+        rlRun "test -e test.zone.signed" 0 "Check signed zone were created."
+        rlRun "dnssec-verify $ENGINE -o test test.zone.signed" 0 "Check zone were signed ok"
+        rlRun "named-checkzone test test.zone"
+        rlRun "named-checkzone test test.zone.signed"
+	[ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i
     rlPhaseEnd
 
     rlPhaseStartCleanup
-	rlRun "rm -f $rlRun_LOG"
-	if [ -n "$BACKUP_RESOLV" ]; then
-		rlRun "rm -f /etc/resolv.conf"
-		rlRun "mv $BACKUP_RESOLV /etc/resolv.conf"
-	fi
+        rlRun "softhsm2-util --token rpm --delete-token"
+        rlRun "popd"
+        rlRun "rm -rf $TmpDir"
     rlPhaseEnd
 
 rlJournalPrintText