xmlsectool can't find keys on eTokenPro

[Rainer Hoerbe]

I initialized a Safenet eTokenPro with pkcs11-tool and can list key and cert. 

pkcs11-tool --module $PKCS11_CARD_DRIVER --login --pin $USERPIN --list-objects
Using slot 0 with a present token (0x0)
Private Key Object; RSA 
  label:      test
  ID:         01
  Usage:      decrypt, sign, unwrap
Public Key Object; RSA 2048 bits
  label:      test
  ID:         01
  Usage:      encrypt, verify, wrap



When I try to sign with xmlsectool, it does not find the objects:


/opt/xmlsectool-2/xmlsectool.sh --sign --pkcs11Config eToken.cfg --keystoreProvider sun.security.pkcs11.SunPKCS11 --inFile md.xml --key test --keyPassword Secret.1 --outFile md_signed.xml  —verbose
...
DEBUG CredentialHelper - Initializing PKCS11 keystore
sunpkcs11: login succeeded
ERROR XMLSecTool - Unable to recover key entry from PKCS11 store
java.security.cert.CertificateException: unknown type of key entry in keystore
	at net.shibboleth.tool.xmlsectool.CredentialHelper.getCredentialFromKeystore(CredentialHelper.java:212) ~[xmlsectool-2.0.0.jar:na]
	at net.shibboleth.tool.xmlsectool.CredentialHelper.getPKCS11Credential(CredentialHelper.java:179) ~[xmlsectool-2.0.0.jar:na]
	at net.shibboleth.tool.xmlsectool.XMLSecTool.getCredential(XMLSecTool.java:901) [xmlsectool-2.0.0.jar:na]
	at net.shibboleth.tool.xmlsectool.XMLSecTool.main(XMLSecTool.java:148) [xmlsectool-2.0.0.jar:na]



I am using openjdk version „1.8.0_144“ on Centos 7.4


- Rainer