diff --git a/bin/tests/system/upforwd/clean.sh b/bin/tests/system/upforwd/clean.sh
index 45179ac34f..3952354ee0 100644
--- a/bin/tests/system/upforwd/clean.sh
+++ b/bin/tests/system/upforwd/clean.sh
@@ -25,3 +25,5 @@ rm -f dig.out.ns1 dig.out.ns2 dig.out.ns1 dig.out.ns3 dig.out.ns1.after
 rm -f ns1/*.jnl ns2/*.jnl ns3/*.jnl ns1/example.db ns2/*.bk ns3/*.bk
 rm -f ns3/nomaster1.db
 rm -f */named.memstats
+rm -f Ksig0.example2.*
+rm -f keyname
diff --git a/bin/tests/system/upforwd/setup.sh b/bin/tests/system/upforwd/setup.sh
index 5e10d88ccc..9e1f437e6a 100644
--- a/bin/tests/system/upforwd/setup.sh
+++ b/bin/tests/system/upforwd/setup.sh
@@ -24,7 +24,16 @@ rm -f ns1/example2.db.jnl ns2/example2.bk ns2/example2.bk.jnl
 cp -f ns3/nomaster.db ns3/nomaster1.db
 rm -f Ksig0.example2.*
 
+#
+# SIG(0) required cryptographic support which may not be configured.
+#
 test -r $RANDFILE || $GENRANDOM 400 $RANDFILE 
-keyname=`$KEYGEN  -q -r $RANDFILE -n HOST -a RSASHA1 -b 1024 -T KEY sig0.example2`
-cat ns1/example1.db $keyname.key > ns1/example2.db
-echo $keyname > keyname
+keyname=`$KEYGEN  -q -r $RANDFILE -n HOST -a RSASHA1 -b 1024 -T KEY sig0.example2 2>/dev/null`
+if test -n "$keyname"
+then
+	cat ns1/example1.db $keyname.key > ns1/example2.db
+	echo $keyname > keyname
+else
+	cat ns1/example1.db > ns1/example2.db
+	rm -f keyname
+fi
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
index 0491596ff5..3d283570f2 100644
--- a/bin/tests/system/upforwd/tests.sh
+++ b/bin/tests/system/upforwd/tests.sh
@@ -182,19 +182,24 @@ done
 if [ $ret != 0 ] ; then echo "I:failed"; status=`expr $status + $ret`; fi
 n=`expr $n + 1`
 
-echo "I:checking update forwarding to with sig0 ($n)"
-keyname=`cat keyname`
-$NSUPDATE -k $keyname.private -- - <<EOF
-server 10.53.0.3 5300
-zone example2
-update add unsigned.example2. 600 A 10.10.10.1
-update add unsigned.example2. 600 TXT Foo
-send
+if test -f keyname
+then
+	echo "I:checking update forwarding to with sig0 ($n)"
+	ret=0
+	keyname=`cat keyname`
+	$NSUPDATE -k $keyname.private -- - <<EOF
+	server 10.53.0.3 5300
+	zone example2
+	update add unsigned.example2. 600 A 10.10.10.1
+	update add unsigned.example2. 600 TXT Foo
+	send
 EOF
-$DIG unsigned.example2 A @10.53.0.1 -p 5300 > dig.out.ns1.test$n
-grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
-if [ $ret != 0 ] ; then echo "I:failed"; status=`expr $status + $ret`; fi
-n=`expr $n + 1`
+	$DIG unsigned.example2 A @10.53.0.1 -p 5300 > dig.out.ns1.test$n
+	grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
+	if [ $ret != 0 ] ; then echo "I:failed"; fi
+	status=`expr $status + $ret`
+	n=`expr $n + 1`
+fi
 
 echo "I:exit status: $status"
 exit $status