diff --git a/Sanity/utils/pkcs11-tools/main.fmf b/Sanity/utils/pkcs11-tools/main.fmf
index 0f36b0f..de123e1 100644
--- a/Sanity/utils/pkcs11-tools/main.fmf
+++ b/Sanity/utils/pkcs11-tools/main.fmf
@@ -1,7 +1,9 @@
 summary: PKCS11 tools and operations test
 description: |
     Bug summary: PKCS11 key operations using tools
-    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
+    Issue link: https://issues.redhat.com/browse/RHEL-33729
+    Generate softhsm token RSA keys, each for KSK and ZSK.
+    Then use bind tools to actually create small signed content and verify it is dnssec compatible.
 contact: Petr Mensik <pemensik@redhat.com>
 test: ./runtest.sh
 framework: beakerlib
@@ -10,7 +12,7 @@ enabled: true
 tag:
   - TIPpass
 link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
+  - relates: https://issues.redhat.com/browse/RHEL-33729
 adjust+:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6
@@ -21,3 +23,4 @@ recommend+:
   - softhsm
   - opensc
   - pkcs11-provider
+  - openssl-engine
diff --git a/Sanity/utils/pkcs11-tools/runtest.sh b/Sanity/utils/pkcs11-tools/runtest.sh
index e15d3ff..e57646f 100755
--- a/Sanity/utils/pkcs11-tools/runtest.sh
+++ b/Sanity/utils/pkcs11-tools/runtest.sh
@@ -105,29 +105,9 @@ rlJournalStart
 	rlRun "make_openssl_conf | tee openssl.conf" 0 "Make provider enabled OpenSSL configuration"
         rlRun "make_localhost_zone > test.zone" 0 "Create test zone"
 	export OPENSSL_CONF="$TmpDir/openssl.conf"
-        rlLog "OPENSSL_CONF=$TmpDir/openssl.conf"
-    rlPhaseEnd
-
-    rlPhaseStartSetup "Prepare token"
-        # This test prepares token to be used by the root user, not really complicating it with file access rights.
-        # It may not emulare properly what is used by named
-	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -L" 0 "check slots"
-	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -T" 0 "check tokens"
-	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:2048 --label test-zsk" 0 "generate new pair"
-	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:4096 --label test-ksk" 0 "generate new pair"
-	rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -O" 0 "check objects saved"
-	rlRun "ZSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-zsk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot zsk URI"
-	rlRun "KSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-ksk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot ksk URI"
-        rlRun "ZSK_URI=\"${ZSK_URI%;type=public}\"" 0 "Remove public type from ZSK URI"
-        rlRun "KSK_URI=\"${KSK_URI%;type=public}\"" 0 "Remove public type from KSK URI"
-	rlRun "test -n \"$ZSK_URI\"" 0 "Check URI were obtained"
-	rlRun "test -n \"$KSK_URI\"" 0 "Check URI were obtained"
-	rlRun "openssl pkey -in '$ZSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public ZSK key"
-	rlRun "openssl pkey -in '$KSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public KSK key"
-    rlPhaseEnd
-
-    rlPhaseStartTest "Test DNSSEC operations on token"
+        rlLog "OPENSSL_CONF=$OPENSSL_CONF"
         DNSSEC_ENGINE=""
+        OSSL_ENGINE=""
         if [ "$USE_ENGINE" = auto ]; then
             if rlIsRHEL '<10' || rlIsFedora '<32' || rlIsCentOS '<10'; then
                 USE_ENGINE='y'
@@ -136,17 +116,46 @@ rlJournalStart
         if [ "$USE_ENGINE" = y ]; then
                 rlLog "Using OpenSSL engine, legacy mode"
                 DNSSEC_ENGINE="-E $ENGINE"
+                OSSL_ENGINE="-engine $ENGINE"
             else
                 rlLog "Not using engine, using OpenSSL provider"
         fi
-	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
-	rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"
-        rlRun "dnssec-signzone $DNSSEC_ENGINE -S -o test test.zone" 0 "Create zone signatures"
-        rlRun "test -e test.zone.signed" 0 "Check signed zone were created."
-        rlRun "dnssec-verify $DNSSEC_ENGINE -o test test.zone.signed" 0 "Check zone were signed ok"
-        rlRun "named-checkzone test test.zone"
-        rlRun "named-checkzone test test.zone.signed"
-	[ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i
+    rlPhaseEnd
+
+    rlPhaseStartSetup "Prepare token"
+        # This test prepares token to be used by the root user, not really complicating it with file access rights.
+        # It may not emulare properly what is used by named
+        rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -L" 0 "check slots"
+        rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -T" 0 "check tokens"
+        rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:2048 --label test-zsk" 0 "generate new pair"
+        rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:4096 --label test-ksk" 0 "generate new pair"
+        rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -O" 0 "check objects saved"
+        rlRun "ZSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-zsk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot zsk URI"
+        rlRun "KSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-ksk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot ksk URI"
+        rlRun "ZSK_URI=\"${ZSK_URI%;type=public}\"" 0 "Remove public type from ZSK URI"
+        rlRun "KSK_URI=\"${KSK_URI%;type=public}\"" 0 "Remove public type from KSK URI"
+        rlRun "test -n \"$ZSK_URI\"" 0 "Check URI were obtained"
+        rlRun "test -n \"$KSK_URI\"" 0 "Check URI were obtained"
+        rlRun "openssl pkey $OSSL_ENGINE -in '$KSK_URI?pin-source=$PIN_SOURCE' -pubout" 0,1 "Test OpenSSL knows the public KSK key"
+        rlRun "openssl pkey $OSSL_ENGINE -in '$ZSK_URI?pin-source=$PIN_SOURCE' -pubout" 0,1 "Test OpenSSL knows the public ZSK key"
+        if openssl storeutl -help >& /dev/null; then
+            rlRun "openssl storeutl $OSSL_ENGINE -text '$KSK_URI?pin-source=$PIN_SOURCE'" 0,1 "Test OpenSSL knows the public KSK key"
+            rlRun "openssl storeutl $OSSL_ENGINE -text '$ZSK_URI?pin-source=$PIN_SOURCE'" 0,1 "Test OpenSSL knows the public ZSK key"
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartTest "Test DNSSEC operations on token"
+        rlRun "ORIGIN='test'"
+        rlRun "ZONEFILE='test.zone'"
+        rlRun "SIGNEDFILE='test.zone.signed'"
+        rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" $ORIGIN" 0 "Import dnssec ZSK"
+        rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK $ORIGIN" 0 "Import dnssec KSK"
+        rlRun "dnssec-signzone $DNSSEC_ENGINE -S -o $ORIGIN -f $SIGNEDFILE $ZONEFILE" 0 "Create zone signatures"
+        rlRun "test -e $SIGNEDFILE" 0 "Check signed zone were created."
+        rlRun "dnssec-verify $DNSSEC_ENGINE -o $ORIGIN $SIGNEDFILE" 0 "Check zone were signed ok"
+        rlRun "named-checkzone $ORIGIN $ZONEFILE" 0 "Validate input zone file"
+        rlRun "named-checkzone $ORIGIN $SIGNEDFILE" 0 "Validate signed zone file"
+        [ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i
     rlPhaseEnd
 
     rlPhaseStartCleanup