--- a/ipaserver/install/opendnssecinstance.py
+++ b/ipaserver/install/opendnssecinstance.py
@@ -199,6 +199,9 @@ class OpenDNSSECInstance(service.Service
         if not self.fstore.has_file(paths.SYSCONFIG_ODS):
             self.fstore.backup_file(paths.SYSCONFIG_ODS)
 
+        # create the configfile, opendnssec-enforcer doesn't ship it
+        open(paths.SYSCONFIG_ODS, 'a').close()
+
         directivesetter.set_directive(paths.SYSCONFIG_ODS,
                                       'SOFTHSM2_CONF',
                                       paths.DNSSEC_SOFTHSM2_CONF,