private key not available for client_cert_cb

George whippet0 at
Mon Jan 11 04:01:28 UTC 2021


     I had a look at the pkcs11-helper and can see where the 
RSA_METHOD_FLAG_NO_CHECK is being set. It's using a session object 
called pkcs11h_openssl_session_t, which I do not see in the libp11 or 
openSC code.

Right now I am using the "libp11" DLL (i.e. 
libp11-libp11-0.4.11\src\pkcs11.dll) with my PKCS11 smart card 
middleware DLL. Should I be using the OpenSC pkcs11 DLL instead of my 
middleware DLL if I am using libp1?

Do you know if it is normal to see exceptions related to the PKCS11 
function calls in the libp11 code? For example, I can see the following 
function generate an exception on C_GetSlotList(...) multiple times but 
it eventually is successful.  Is this normal behaviour?

int pkcs11_enumerate_slots(PKCS11_CTX *ctx, PKCS11_SLOT **slotp, 
unsigned int *countp)
. . .
     rv = cpriv->method->C_GetSlotList(FALSE, NULL_PTR, &nslots);
. . .


On 2021-01-08 6:32 p.m., Michael Wojcik wrote:
>> From: openssl-users <openssl-users-bounces at> On Behalf Of George
>> Sent: Friday, 8 January, 2021 14:35
>> The comment indicates that the flag RSA_METHOD_FLAG_NO_CHECK should be set
>> for smart cards[...]
>> However, it is not actually set when I use a debugger to inspect the flag.
>> Does it need to be set? If so, how is this done?
> If memory serves, the PKCS#11 implementation invoked by the pkcs11 engine is supposed to set it.
> See for example this patch to OpenSC's pkcs11-helper library:
> (That patch actually is to set a different flag, but it shows the code in question.)
> I know, that's probably not terribly helpful.
> If you do a web search for something like
>          pkcs11 "RSA_METHOD_FLAG_NO_CHECK"
> you'll probably find a number of hits where other people ran into similar problems.
> Isn't PKCS#11 grand? If you're bored with all the interoperability problems of X.509, PKIX, and TLS, we have good news!
> --
> Michael Wojcik

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the openssl-users mailing list