diff --git a/CHANGES b/CHANGES
index 07805aabb4..5dfe715e70 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3302.	[bug]		dns_dnssec_findmatchingkeys could fail to find
+			keys if the zone name contained character that
+			required special mappings. [RT #28600]
+
 3301.	[contrib]	Update queryperf to build on darwin.  Add -R flag
 			for non-recursive queries. [RT #28565]
 
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 637f08b59a..ed94525478 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -1254,7 +1254,7 @@ dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
 	isc_dir_init(&dir);
 
 	isc_buffer_init(&b, namebuf, sizeof(namebuf) - 1);
-	RETERR(dns_name_totext(origin, ISC_FALSE, &b));
+	RETERR(dns_name_tofilenametext(origin, ISC_FALSE, &b));
 	len = isc_buffer_usedlength(&b);
 	namebuf[len] = '\0';