diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index d615e58d06..5077702254 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-keyfromlabel.c,v 1.28 2009/11/23 02:55:40 each Exp $ */
+/* $Id: dnssec-keyfromlabel.c,v 1.29 2009/11/25 23:00:32 marka Exp $ */
 
 /*! \file */
 
@@ -146,6 +146,7 @@ main(int argc, char **argv) {
 	isc_boolean_t	unsetdel = ISC_FALSE;
 	isc_boolean_t	genonly = ISC_FALSE;
 	isc_boolean_t	use_nsec3 = ISC_FALSE;
+	unsigned char	c;
 
 	if (argc == 1)
 		usage();
@@ -178,9 +179,10 @@ main(int argc, char **argv) {
 			engine = isc_commandline_argument;
 			break;
 		case 'f':
-			if (toupper(isc_commandline_argument[0]) == 'K')
+			c = (unsigned char)(isc_commandline_argument[0]);
+			if (toupper(c) == 'K')
 				kskflag = DNS_KEYFLAG_KSK;
-			else if (toupper(isc_commandline_argument[0]) == 'R')
+			else if (toupper(c) == 'R')
 				revflag = DNS_KEYFLAG_REVOKE;
 			else
 				fatal("unknown flag '%s'",
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 7095170711..befd7385f0 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-keygen.c,v 1.107 2009/11/23 02:55:40 each Exp $ */
+/* $Id: dnssec-keygen.c,v 1.108 2009/11/25 22:58:48 marka Exp $ */
 
 /*! \file */
 
@@ -228,6 +228,7 @@ main(int argc, char **argv) {
 	isc_boolean_t	genonly = ISC_FALSE;
 	isc_boolean_t	quiet = ISC_FALSE;
 	isc_boolean_t	show_progress = ISC_FALSE;
+	unsigned char	c;
 
 	if (argc == 1)
 		usage();
@@ -295,9 +296,10 @@ main(int argc, char **argv) {
 			rsa_exp = 1;
 			break;
 		case 'f':
-			if (toupper(isc_commandline_argument[0]) == 'K')
+			c = (unsigned char)(isc_commandline_argument[0]);
+			if (toupper(c) == 'K')
 				kskflag = DNS_KEYFLAG_KSK;
-			else if (toupper(isc_commandline_argument[0]) == 'R')
+			else if (toupper(c) == 'R')
 				revflag = DNS_KEYFLAG_REVOKE;
 			else
 				fatal("unknown flag '%s'",