xmlsectool can't find keys on eTokenPro

[Ian Young]

> On 19 Sep 2017, at 16:45, Rainer Hoerbe <rainer at hoerbe.at> wrote:
> 
> Do you use some legacy syntax for the -key option? 


No, the format of the -key option to openssl req depends on the engine, I think. In this case 0:10 represents slotid 0 keyid 10.

This is the article I used to get my token working:

https://raymii.org/s/articles/Get_Started_With_The_Nitrokey_HSM.html <https://raymii.org/s/articles/Get_Started_With_The_Nitrokey_HSM.html>

I don't have the same token you do, and as I implied before one of the problems with this area is that every single token in the world seems to work in a slightly different way. So it's hard for me to make practical suggestions as to how to configure your token. In particular, I have no knowledge of the PKCS11-URIs you're using. So what you're doing may be equivalent to what I'm doing, or it may not be, I can't tell.

You've hit the limit of my knowledge, I'm afraid. If you wanted to buy a Nitrokey HSM, I am pretty sure we could get you running, but I can't debug what I can't replicate (and I think we're agreed that this actually isn't an XMLSecTool problem, so in terms of configuring the token the OpenSC lists might have more people who understand your token at this level).

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170919/e4ed516a/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170919/e4ed516a/attachment.p7s>