Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to use pkcs11-tool with yubihsm-pkcs11.dylib module #356

Open
tiger-at-cranius opened this issue Aug 1, 2023 · 1 comment
Open

Comments

@tiger-at-cranius
Copy link

On two different machines (MacOS and on an Ubuntu VM running on WIndows Host), I have been able to set up the YubiHSM SDK and connect to the HSM using the shell, as well as access the HSM through the openssl command using the PKCS11 engine, as described in the guide https://developers.yubico.com/YubiHSM2/Usage_Guides/OpenSSL_with_pkcs11_engine.html.
However, when I try to run pkcs11-tool --module /path/to/yubihsm_pkcs11.so --login --pin 0001password \ --keypairgen --key-type rsa:2048 --label "my_key" --usage-sign, or any other pkcs11-tool command with the specified module, I get this error:

Main C_Initialize(NULL) rv:CKR_ARGUMENTS_BAD
error: PKCS11 function C_Initialize failed: rv = CKR_ARGUMENTS_BAD (0x7)
Aborting.

The bad argument in question seems to be the module argument, as the same error appears when just listing objects or even running the test option. That would indicate some incompatibility of the YubiHSM PKCS11 library and the pkcs11-tool.

@qpernil
Copy link
Contributor

qpernil commented Aug 28, 2023

It has been tested with pkcs11-tool and should work. My guess would be that it is not finding the config file. You can set the YUBIHSM_PKCS11_DBG environment variable to get debugging even at startup (i.e. before trying to read the config file).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants