<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">Am 19.09.2017 um 16:06 schrieb Ian Young <<a href="mailto:ian@iay.org.uk" class="">ian@iay.org.uk</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On 19 Sep 2017, at 14:42, Rainer Hoerbe <<a href="mailto:rainer@hoerbe.at" class="">rainer@hoerbe.at</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">This seems to be the cause. `pkcs11-tool -cert` does list pubkeys as well.<br class=""></div></div></blockquote><div class=""><br class=""></div><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="">keytool shows no objects on the token. Also, when I try to use the token with `openssl -engine pkcs11` it will not find the key (possibly I did not get the the PKCS11-URL format right?). The vendor’s SAC-tool will show the same label/alias as pkcs11-tool.</div></div></div></div></blockquote><div class=""><br class=""></div><div class="">If keytool doesn't understand the token properly, you won't get good results with anything written in Java that relies on the Java PKCS#11 bridge. You need to use vendor tools or the pkcs tools to set the token up before you will be able to make progress.</div></div></div></div></blockquote><br class=""></div><div>For the record: The sun pkcs11 provider does not retrieve objects (priv/pub keys and certs) that cannot be matched with an ID attribute:</div><div><br class=""></div><div><a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#KeyStoreRestrictions" class="">http://docs.oracle.com/javase/7/docs/technotes/guides/security/p11guide.html#KeyStoreRestrictions</a></div><div><br class=""></div><div>Therefore it is required to set the —id option when initializing a keystore, either when creating the keypair on the token, or copying one generated outside.</div><div><br class=""></div><div>A working script that will initialize a pkcs11 device and test the retrieval using keytool can be found here:</div><div><br class=""></div><div><a href="https://github.com/identinetics/keymgmt/blob/master/install/tests/test_hsm_token.sh" class="">https://github.com/identinetics/keymgmt/blob/master/install/tests/test_hsm_token.sh</a></div><div><br class=""></div><div>- Rainer</div><div><br class=""></div><br class=""></body></html>