xmlsectool can't find keys on eTokenPro

[Rainer Hoerbe]

> Am 19.09.2017 um 16:06 schrieb Ian Young <ian at iay.org.uk>:
> 
> 
>> On 19 Sep 2017, at 14:42, Rainer Hoerbe <rainer at hoerbe.at <mailto:rainer at hoerbe.at>> wrote:
>> 
>> This seems to be the cause. `pkcs11-tool -cert` does list pubkeys as well.
> 
>> keytool shows no objects on the token. Also, when I try to use the token with `openssl -engine pkcs11` it will not find the key (possibly I did not get the the PKCS11-URL format right?). The vendor’s SAC-tool will show the same label/alias as pkcs11-tool.
> 
> If keytool doesn't understand the token properly, you won't get good results with anything written in Java that relies on the Java PKCS#11 bridge. You need to use vendor tools or the pkcs tools to set the token up before you will be able to make progress.

For the record: The sun pkcs11 provider does not retrieve objects (priv/pub keys and certs) that cannot be matched with an ID attribute:

http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#KeyStoreRestrictions

Therefore it is required to set the —id option when initializing a keystore, either when creating the keypair on the token, or copying one generated outside.

A working script that will initialize a pkcs11 device and test the retrieval using keytool can be found here:

https://github.com/identinetics/keymgmt/blob/master/install/tests/test_hsm_token.sh

- Rainer


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170930/9f29c72d/attachment-0001.html>