PKCS#11 URI #93

New Issue

2025-05-22T15:37:56+08:00

IsayIsee commented

2025-05-22 15:37:56 +08:00

(Migrated from https://github.com/polhenarejos/pico-hsm)

i want use openssl ca command sign cert, no matter how I set the private_key URI in signing.cnf, I cannot get the CA's private key. I refer to RFC 7512 unsuccessful，what is the correct private key URI?

signing.cnf:

[ ca ]
default_ca = CA_default

[ CA_default ]
dir = .
database = index.txt
serial = serial.txt
new_certs_dir = .
certificate = ca.crt
private_key = pkcs11:id=1;type=private
policy = policy_anything
default_md = sha256
default_days = 3650

[ policy_anything ]
countryName = CN
stateOrProvinceName = SC
localityName = CD
organizationName = TEST
organizationalUnitName = TEST
commonName = TEST CERT
emailAddress = test@test.com

[ v3_ext ]
subjectAltName = @alt_names
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth

[ alt_names ]
DNS.1 = www.example.com
DNS.2 = example.com

E:\CertTest>openssl ca -engine pkcs11 -keyform engine -in request.csr -out signed_cert.crt -config signing.cnf -notext -batch
Engine "pkcs11" set.
Using configuration from signing.cnf
Enter PKCS#11 token PIN for Pico-HSM (UserPIN):

PKCS11_get_private_key returned NULL
Could not find CA private key from org.openssl.engine:pkcs11:pkcs11:id=1;type=private;
E8010000:error:40000065:pkcs11 engine:ERR_ENG_error:object not found:eng_back.c:202:
E8010000:error:13000080:engine routines:ENGINE_load_private_key:failed loading private key:crypto\engine\eng_pkey.c:79:

i want use openssl ca command sign cert, no matter how I set the private_key URI in signing.cnf, I cannot get the CA's private key. I refer to RFC 7512 unsuccessful，what is the correct private key URI? signing.cnf: ``` [ ca ] default_ca = CA_default [ CA_default ] dir = . database = index.txt serial = serial.txt new_certs_dir = . certificate = ca.crt private_key = pkcs11:id=1;type=private policy = policy_anything default_md = sha256 default_days = 3650 [ policy_anything ] countryName = CN stateOrProvinceName = SC localityName = CD organizationName = TEST organizationalUnitName = TEST commonName = TEST CERT emailAddress = test@test.com [ v3_ext ] subjectAltName = @alt_names keyUsage = digitalSignature, keyEncipherment extendedKeyUsage = serverAuth, clientAuth [ alt_names ] DNS.1 = www.example.com DNS.2 = example.com ``` ``` E:\CertTest>openssl ca -engine pkcs11 -keyform engine -in request.csr -out signed_cert.crt -config signing.cnf -notext -batch Engine "pkcs11" set. Using configuration from signing.cnf Enter PKCS#11 token PIN for Pico-HSM (UserPIN): PKCS11_get_private_key returned NULL Could not find CA private key from org.openssl.engine:pkcs11:pkcs11:id=1;type=private; E8010000:error:40000065:pkcs11 engine:ERR_ENG_error:object not found:eng_back.c:202: E8010000:error:13000080:engine routines:ENGINE_load_private_key:failed loading private key:crypto\engine\eng_pkey.c:79: ```

IsayIsee commented

2025-05-22 15:51:30 +08:00

(Migrated from https://github.com/polhenarejos/pico-hsm)

i get #27

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/pico-hsm#93