diff --git a/lib/dns/tests/Kyuafile b/lib/dns/tests/Kyuafile
index db755f0b32..af44796450 100644
--- a/lib/dns/tests/Kyuafile
+++ b/lib/dns/tests/Kyuafile
@@ -6,7 +6,7 @@ atf_test_program{name='db_test'}
 atf_test_program{name='dbdiff_test'}
 atf_test_program{name='dbiterator_test'}
 atf_test_program{name='dbversion_test'}
-atf_test_program{name='dh_test'}
+tap_test_program{name='dh_test'}
 atf_test_program{name='dispatch_test'}
 atf_test_program{name='dnstap_test'}
 atf_test_program{name='dst_test'}
diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
index 1ffac543fc..50d03e56cb 100644
--- a/lib/dns/tests/Makefile.in
+++ b/lib/dns/tests/Makefile.in
@@ -123,9 +123,9 @@ dbversion_test@EXEEXT@: dbversion_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIB
 				${ISCLIBS} ${LIBS}
 
 dh_test@EXEEXT@: dh_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
-			dh_test.@O@ dnstest.@O@ ${DNSLIBS} \
-			${ISCLIBS} ${LIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${CMOCKA_CFLAGS} \
+		${LDFLAGS} -o $@ dh_test.@O@ dnstest.@O@ \
+		${DNSLIBS} ${ISCLIBS} ${LIBS} ${CMOCKA_LIBS}
 
 dispatch_test@EXEEXT@: dispatch_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
@@ -239,9 +239,9 @@ time_test@EXEEXT@: time_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 WRAP = -Wl,--wrap=isc__mem_put,--wrap=isc__mem_get,--wrap=isc_mem_attach,--wrap=isc_mem_detach
 tkey_test@EXEEXT@: tkey_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	if test "${LD_WRAP}" = true; then wrap="${WRAP}"; fi; \
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${CMOCKA_CFLAGS} ${LDFLAGS} -o $@ \
-			tkey_test.@O@ ${DNSLIBS} \
-			${ISCLIBS} ${LIBS} ${CMOCKA_LIBS} $$wrap
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${CMOCKA_CFLAGS} \
+			${LDFLAGS} -o $@ tkey_test.@O@ \
+			${DNSLIBS} ${ISCLIBS} ${LIBS} ${CMOCKA_LIBS} $$wrap
 
 tsig_test@EXEEXT@: tsig_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
diff --git a/lib/dns/tests/dh_test.c b/lib/dns/tests/dh_test.c
index 5138a16aba..d83d9f59fe 100644
--- a/lib/dns/tests/dh_test.c
+++ b/lib/dns/tests/dh_test.c
@@ -9,15 +9,21 @@
  * information regarding copyright ownership.
  */
 
-
-/* ! \file */
-
 #include <config.h>
 
-#include <atf-c.h>
+#if HAVE_CMOCKA
 
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+
+#include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 
+#define UNIT_TESTING
+#include <cmocka.h>
+
 #include <isc/util.h>
 #include <isc/string.h>
 
@@ -31,61 +37,82 @@
 #include "dnstest.h"
 
 #if USE_OPENSSL
-ATF_TC(isc_dh_computesecret);
-ATF_TC_HEAD(isc_dh_computesecret, tc) {
-	atf_tc_set_md_var(tc, "descr", "OpenSSL DH_compute_key() failure");
+static int
+_setup(void **state) {
+	isc_result_t result;
+
+	UNUSED(state);
+
+	result = dns_test_begin(NULL, false);
+	assert_int_equal(result, ISC_R_SUCCESS);
+
+	return (0);
 }
-ATF_TC_BODY(isc_dh_computesecret, tc) {
+
+static int
+_teardown(void **state) {
+	UNUSED(state);
+
+	dns_test_end();
+
+	return (0);
+}
+
+/* OpenSSL DH_compute_key() failure */
+static void
+dh_computesecret(void **state) {
 	dst_key_t *key = NULL;
 	isc_buffer_t buf;
 	unsigned char array[1024];
-	isc_result_t ret;
+	isc_result_t result;
 	dns_fixedname_t fname;
 	dns_name_t *name;
 
-	UNUSED(tc);
-
-	ret = dns_test_begin(NULL, false);
-	ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
+	UNUSED(state);
 
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_constinit(&buf, "dh.", 3);
 	isc_buffer_add(&buf, 3);
-	ret = dns_name_fromtext(name, &buf, NULL, 0, NULL);
-	ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
+	result = dns_name_fromtext(name, &buf, NULL, 0, NULL);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
-	ret = dst_key_fromfile(name, 18602, DST_ALG_DH,
-			       DST_TYPE_PUBLIC | DST_TYPE_KEY,
-			       "./", mctx, &key);
-	ATF_REQUIRE_EQ(ret, ISC_R_SUCCESS);
+	result = dst_key_fromfile(name, 18602, DST_ALG_DH,
+				  DST_TYPE_PUBLIC | DST_TYPE_KEY,
+				  "./", mctx, &key);
+	assert_int_equal(result, ISC_R_SUCCESS);
 
 	isc_buffer_init(&buf, array, sizeof(array));
-	ret = dst_key_computesecret(key, key, &buf);
-	ATF_REQUIRE_EQ(ret, DST_R_NOTPRIVATEKEY);
-	ret = key->func->computesecret(key, key, &buf);
-	ATF_REQUIRE_EQ(ret, DST_R_COMPUTESECRETFAILURE);
+	result = dst_key_computesecret(key, key, &buf);
+	assert_int_equal(result, DST_R_NOTPRIVATEKEY);
+	result = key->func->computesecret(key, key, &buf);
+	assert_int_equal(result, DST_R_COMPUTESECRETFAILURE);
 
 	dst_key_free(&key);
-	dns_test_end();
-}
-#else /* USE_OPENSSL */
-ATF_TC(untested);
-ATF_TC_HEAD(untested, tc) {
-	atf_tc_set_md_var(tc, "descr", "skipping dh test");
-}
-ATF_TC_BODY(untested, tc) {
-	UNUSED(tc);
-	atf_tc_skip("dh test is broken with PKCS#11");
 }
 #endif /* USE_OPENSSL */
-/*
- * Main
- */
-ATF_TP_ADD_TCS(tp) {
+
+int
+main(void) {
 #if USE_OPENSSL
-	ATF_TP_ADD_TC(tp, isc_dh_computesecret);
+	const struct CMUnitTest tests[] = {
+		cmocka_unit_test_setup_teardown(dh_computesecret,
+						_setup, _teardown),
+	};
+
+	return (cmocka_run_group_tests(tests, NULL, NULL));
 #else
-	ATF_TP_ADD_TC(tp, untested);
+	print_message("1..0 # Skipped: dh test broken with PKCS11");
 #endif
-	return (atf_no_error());
 }
+
+#else /* HAVE_CMOCKA */
+
+#include <stdio.h>
+
+int
+main(void) {
+	printf("1..0 # Skipped: cmocka not available\n");
+	return (0);
+}
+
+#endif