<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">Am 19.09.2017 um 09:22 schrieb Ian Young <<a href="mailto:ian@iay.org.uk" class="">ian@iay.org.uk</a>>:</div><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class=""><br class=""></div><div class="">There is no certificate there, just the two parts of an RSA keypair (private key and public key). Here's what I see with a token that does work with XMLSecTool:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Certificate Object, type = X.509 cert</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> label: key10</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> ID: 6b65793130</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Public Key Object; RSA 2048 bits</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> label: key10</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> ID: 6b65793130</span></div><div style="margin: 0px; line-height: normal; font-family: 'Andale Mono'; color: rgb(77, 47, 45); background-color: rgb(223, 219, 195);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Usage: encrypt, verify</span></div></blockquote></div><div class=""><br class=""></div><div class="">Note that the first object is of a different kind than in your case. That may be significant.</div></div></div></div></blockquote><div><br class=""></div><div>This seems to be the cause. `pkcs11-tool -cert` does list pubkeys as well.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class=""><br class=""></div><div class="">At this point, XMLSecTool is looking at the KeyStore.Entry corresponding to the alias you provided.</div><div class=""><br class=""></div><div class="">Examining the code, though, there a are a couple of possibilities.</div><div class=""><br class=""></div><div class="">One of them, unfortunately, is that no such KeyEntry was found (that would be a bug). You could try a completely different alias to see if you get the same result; if so, please file a JIRA case.</div></div></div></div></blockquote><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">The other possibility is that the KeyEntry was found, but it was not one of the types of KeyEntry that XMLSecTool knows how to deal with. It can handle PrivateKeyEntry and TrustedCertificateEntry. What appears in the "keystore" depends on the PKCS11 bridge and to a certain extent to the native drivers as well, so there's a lot of variation and it's possible we haven't covered one. It's also possible that this is a result of your not having a certificate object on the token after all, just a private key (which I think results in a SecretKeyEntry rather than a PrivateKeyEntry). XMLSecTool (currently) requires you to have something it can extract a certificate from.</div><div class=""><br class=""></div><div class="">One thing you might try is to list the keystore entries with keytool rather than pkcs11-tool. That way you'll get a more direct indication of what the stack has turned the objects on the token into in Java keystore terms; the results of this can be surprising.</div></div></div></div></blockquote><div><br class=""></div><div>keytool shows no objects on the token. Also, when I try to use the token with `openssl -engine pkcs11` it will not find the key (possibly I did not get the the PKCS11-URL format right?). The vendor’s SAC-tool will show the same label/alias as pkcs11-tool.</div><br class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class=""><br class=""></div><div class="">Let me know if you can make progress based on the above. If that's not possible, I guess I'd have to put it down to "every ^*^&*^&! token is different" and ask you to consider if you might have a spare token you could mail me that I can use to try and debug this with.</div></div></div></div></blockquote><div><br class=""></div><div>I tried to create a create certificate from the existing RSA key pair on the token. Spending quite a few hours I had no success so far. I do not want to re-create the key pair, because I want to replace pyff’s signing with xmlsectool because of xmldsig interop issues. pyff’s xmldsig library can create a signature just from the key pair, however, so I do not have certificates so far. Do you see any trivial option to tweak xmlsectool into using the public key instead of a x509 cert?</div><div><br class=""></div><div><br class=""></div><div>thanks, Rainer</div></div></body></html>