Replies: 5 comments 5 replies
-
|
Does it show any exception in the log file of EJBCA? |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
I suspect some configuration setting on the HSM related to PKCS#11 sessions, perhaps not allowing multiple sessions or something similar. |
Beta Was this translation helpful? Give feedback.
-
|
@primetomas thanks!
for
not yet, because previously it does not help and it seems to be a matter of HSM authentication itself. but I will try this. once tested, I will report here.
these do not work either. (I tried
anyway to confirm your hypothesis? FYI, Another CA server product which I tested concurrently, can create key on HSM where ejbca fails to create. I think configuration of underlying PKCS11 library is exactly same. regards, |
Beta Was this translation helpful? Give feedback.
-
|
@primetomas I tried but I find pkcs11 error when generateKey fails with full stacktrace is here: hope this helps regards, |
Beta Was this translation helpful? Give feedback.
-
|
Interesting, it means it gives an error on a very standard call "c_findObjects(session, CKA_TOKEN=true, CKA_LABEL=label) What is the label name of the key you try to generate? Does it contain any non-ascii characters? |
Beta Was this translation helpful? Give feedback.
-
|
can you remove the "_" from the key alias? |
Beta Was this translation helpful? Give feedback.
-
|
Btw, you will get more details help by sales/PS. I'm merely guessing here in the Community. Another idea that I though of is. You are using the container, is that right? How do you configure the PKCS#11 driver into the container in this case? Perhaps it can be something with that, since it gives strange responses to very standard PKCS#11 calls. PKCS#11 is quite standardized, and P11NG is already tested with > 10 HSMs, including Safenet ProtectServer, so I think it is more likely that it is something around than that the usage of PKCS#11 itself. |
Beta Was this translation helpful? Give feedback.
-
what does the
first time I tried with
we believe we were able to setup our HSM so that at least it can generate key with some kind of pkcs11 library, because another CA server product can generate keys with exactly same setting. but FYI, we installed ptk 7.2 from debian package that Thales provides to us, then create proper /etc/default/et_hsm like that and libcryptoki.so linked to libcthsm.so. any other idea where to check?
thanks, I have already tried to contact Thales sales. |
Beta Was this translation helpful? Give feedback.
-
|
Long time no see, the following hack solved the problem by avoiding Here we want to create an object for ejbca using a token on PS3 called ThalesHSMSlot.
This will ensure that For this method to work, a new cryptotoken must be created before creating the HSM's token, the third method allows the creation of a new cryptotoken each time without increasing the number of cryptotokens. maybe in some situation, ejbca's PKCS11CryptoToken driver that logs into the HSM session using HSM PIN only the first time, but skips logins thereafter. If we successfully create a dummy cryptotoken, we can use the authorized session afterwards, so there may not be a problem with skipped logins. hope this helps. regards, |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
it is continued from #230
in above discussion, we could run ejbca correctly with ptk emurator mode hsm by using
ejbca-eeandPkcs11NgCryptoToken, then proceeding to real hardware (ProtectServer 3+ External).cryptotoken creation seems to work. but when we try to list keys in created cryptotoken, ejbca.sh throws following error
CryptoToken is not active:of course, we created cryptotoken with
--autoactivate trueandejbca.sh cryptotoken listshows it actually activatedkey pair generation also throws strange error which did not happen with ptk emurator mode hsm
Error retrieving objects to determine whether alias is used:it seems that
Pkcs11NgCryptoTokencannot authenticate itself correctly with real hardwareProtectServer 3+ External.any ideas?
regards,
Beta Was this translation helpful? Give feedback.
All reactions