private key not available for client_cert_cb
whippet0 at gmail.com
Mon Jan 11 04:01:28 UTC 2021
I had a look at the pkcs11-helper and can see where the
RSA_METHOD_FLAG_NO_CHECK is being set. It's using a session object
called pkcs11h_openssl_session_t, which I do not see in the libp11 or
Right now I am using the "libp11" DLL (i.e.
libp11-libp11-0.4.11\src\pkcs11.dll) with my PKCS11 smart card
middleware DLL. Should I be using the OpenSC pkcs11 DLL instead of my
middleware DLL if I am using libp1?
Do you know if it is normal to see exceptions related to the PKCS11
function calls in the libp11 code? For example, I can see the following
function generate an exception on C_GetSlotList(...) multiple times but
it eventually is successful. Is this normal behaviour?
int pkcs11_enumerate_slots(PKCS11_CTX *ctx, PKCS11_SLOT **slotp,
unsigned int *countp)
. . .
rv = cpriv->method->C_GetSlotList(FALSE, NULL_PTR, &nslots);
. . .
On 2021-01-08 6:32 p.m., Michael Wojcik wrote:
>> From: openssl-users <openssl-users-bounces at openssl.org> On Behalf Of George
>> Sent: Friday, 8 January, 2021 14:35
>> The comment indicates that the flag RSA_METHOD_FLAG_NO_CHECK should be set
>> for smart cards[...]
>> However, it is not actually set when I use a debugger to inspect the flag.
>> Does it need to be set? If so, how is this done?
> If memory serves, the PKCS#11 implementation invoked by the pkcs11 engine is supposed to set it.
> See for example this patch to OpenSC's pkcs11-helper library:
> (That patch actually is to set a different flag, but it shows the code in question.)
> I know, that's probably not terribly helpful.
> If you do a web search for something like
> pkcs11 "RSA_METHOD_FLAG_NO_CHECK"
> you'll probably find a number of hits where other people ran into similar problems.
> Isn't PKCS#11 grand? If you're bored with all the interoperability problems of X.509, PKIX, and TLS, we have good news!
> Michael Wojcik
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the openssl-users