Skip to content
This repository has been archived by the owner on Feb 2, 2023. It is now read-only.

errors when is requested engine information #17

Open
petrovr opened this issue Aug 4, 2019 · 1 comment
Open

errors when is requested engine information #17

petrovr opened this issue Aug 4, 2019 · 1 comment

Comments

@petrovr
Copy link

petrovr commented Aug 4, 2019

OpenSSL engine command support some flags that could be used to obtain information for specified engines(all if not).
Unfortunately ibmpkcs11 engines print a lot of errors.

Tested command : openssl engine -vvvv
Openssl configuration:

openssl_conf = openssl_def

[openssl_def]
engines = engine_section

[engine_section]
engine1 = ibmpkcs11_section

[ibmpkcs11_section]
dynamic_path = ..../src/.libs/ibmpkcs11.so

Error list

139847597369088:error:8007E065:lib(128):PKCS11_PREINIT:unable to load PKCS#11 DSO:../../ibmpkcs11/src/e_pkcs11.c:1432:
139847597369088:error:80064065:lib(128):PKCS11_INIT:unable to load PKCS#11 DSO:../../ibmpkcs11/src/e_pkcs11.c:1565:
139847597369088:error:260BC066:engine routines:int_engine_configure:engine configuration error:crypto/engine/eng_cnf.c:141:
139847597369088:error:0E07606D:configuration file routines:module_run:module initialization error:crypto/conf/conf_mod.c:177:module=engines, value=engine_section, retcode=-1      
139847597369088:error:80083099:lib(128):PKCS11_GET_PKCS11_CIPHERS:No slot selected, please add SLOT_ID=<num> to your openssl.cnf ibmpkcs11_section:../../ibmpkcs11/src/e_pkcs11.c:937:
139847597369088:error:80082099:lib(128):PKCS11_GET_PKCS11_DIGESTS:No slot selected, please add SLOT_ID=<num> to your openssl.cnf ibmpkcs11_section:../../ibmpkcs11/src/e_pkcs11.c:963:

So as engine is not in use yet all those checks could be postponed, right?

Another case is command: openssl engine -t{t}
Engine is not reported as available. Perhaps is related to above errors.

@petrovr
Copy link
Author

petrovr commented Aug 4, 2019

Engine initialization may be is not correct place.
Looking into e_nns actually check for missing arguments (configuration) is performed late - when is requested load of key or certificate.
As e_nss supports OpenSSL STORE2 API configuration is checked when store is opened.
With other words check is performed just "before use".

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant