xmlsectool can't find keys on eTokenPro

[Rainer Hoerbe]

> Am 19.09.2017 um 16:06 schrieb Ian Young <ian at iay.org.uk>:
> 
>> tried to create a create certificate from the existing RSA key pair on the token. Spending quite a few hours I had no success so far. I do not want to re-create the key pair, because I want to replace pyff’s signing with xmlsectool because of xmldsig interop issues. pyff’s xmldsig library can create a signature just from the key pair, however, so I do not have certificates so far.
> 
> I can tell you what I did on the token I use (a Nitrokey HSM). Roughly:
> 
> # make the keypair
> pkcs11-tool --login --pin XXX --keypairgen --key-type rsa:2048 --id 10 --label "test 2048"
> 
> # make a self-signed certificate signed by that keypair
> OPENSSL_CONF=./hsm.conf openssl req -engine pkcs11 -keyform engine -new -key 0:10 -nodes -days 3560 -x509 -sha256 -out key10cert.pem -subj "/C=UK/ST=Scotland/L=Edinburgh/O=Ian A. Young/CN=key10“

This is equivalent what I tried. However, Openssl does not find the object on the HSM. Using p11tool I generated PKCS11-URIs:

p11tool --provider $PYKCS11LIB --list-all --login pkcs11:token=testtoken;id=%01
    Token 'testtoken' with URL 'pkcs11:model=eToken;manufacturer=SafeNet%2c%20Inc.;serial=024d8da4;token=testtoken' requires user PIN
    Object 0:
        URL: pkcs11:model=eToken;manufacturer=SafeNet%2c%20Inc.;serial=024d8da4;token=testtoken;id=%01;object=testkey;type=private
        Type: Private key
        Label: testkey
        Flags: CKA_WRAP/UNWRAP; CKA_PRIVATE; CKA_SENSITIVE; 
        ID: 01
    Object 1:
        URL: pkcs11:model=eToken;manufacturer=SafeNet%2c%20Inc.;serial=024d8da4;token=testtoken;id=%01;object=testkey;type=public
        Type: Public key
        Label: testkey
        Flags: CKA_WRAP/UNWRAP; 
        ID: 01

Neither req, pkey nor rsautl subcommands of openssl will find my keys with the PKCS11-URIs. Certtool from GnuTLs shows the same result. Do you use some legacy syntax for the -key option? 

- Rainer