<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 19 Sep 2017, at 14:42, Rainer Hoerbe <<a href="mailto:rainer@hoerbe.at" class="">rainer@hoerbe.at</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">This seems to be the cause. `pkcs11-tool -cert` does list pubkeys as well.<br class=""></div></div></blockquote><div><br class=""></div><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">keytool shows no objects on the token. Also, when I try to use the token with `openssl -engine pkcs11` it will not find the key (possibly I did not get the the PKCS11-URL format right?). The vendor’s SAC-tool will show the same label/alias as pkcs11-tool.</div></div></div></div></blockquote><div><br class=""></div><div>If keytool doesn't understand the token properly, you won't get good results with anything written in Java that relies on the Java PKCS#11 bridge. You need to use vendor tools or the pkcs tools to set the token up before you will be able to make progress.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">tried to create a create certificate from the existing RSA key pair on the token. Spending quite a few hours I had no success so far. I do not want to re-create the key pair, because I want to replace pyff’s signing with xmlsectool because of xmldsig interop issues. pyff’s xmldsig library can create a signature just from the key pair, however, so I do not have certificates so far.</div></div></div></div></blockquote><div><br class=""></div><div>I can tell you what I did on the token I use (a Nitrokey HSM). Roughly:</div><div><br class=""></div><div># make the keypair</div><div>pkcs11-tool --login --pin XXX --keypairgen --key-type rsa:2048 --id 10 --label "test 2048"</div><div><br class=""></div><div># make a self-signed certificate signed by that keypair</div><div>OPENSSL_CONF=./hsm.conf openssl req -engine pkcs11 -keyform engine -new -key 0:10 -nodes -days 3560 -x509 -sha256 -out key10cert.pem -subj "/C=UK/ST=Scotland/L=Edinburgh/O=Ian A. Young/CN=key10"</div><div><br class=""></div><div># convert the cert to DER</div><div>openssl x509 -in key10cert.pem -out key10cert.der -inform pem -outform der</div><div><br class=""></div><div># write the cert to the HSM</div><div>pkcs11-tool --write-object key10cert.der --type cert --id 10 --login --pin XXX --label key10</div><div><br class=""></div><div>If you use pkcs11-tool --list-objects at this stage you should see that there's a certificate there as well.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">Do you see any trivial option to tweak xmlsectool into using the public key instead of a x509 cert?</div></div></div></div></blockquote><div><br class=""></div><div>It's not trivial to change the code in this way. It's central to XMLSecTool's current operation that it has a certificate and key, not just a key. Obviously it would be possible to extend it, but I think it would be much simpler to get the token set up properly.</div><div><br class=""></div></div><div class=""><span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class=""> -- Ian<br class=""></div><div class=""><br class=""></div></span></div></span><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>