Unexpected error: PKCS11_GET_PKCS11_CIPHERS:No slot selected, please add SLOT_ID=<num> to your openssl.cnf #18
Comments
|
Hello, Could you, please, tell me if this project is being maintained? I've posted three weeks ago and no one reacted since then. Thank you very much |
|
Hi, sorry for the late reply. This project is not actively maintained at the moment. I suggest to use the pkcs11 engine which is part of lib p11: There is also a pkcs11 engine WIP by the openssl project: |
|
Thank you for your answer Patrick, I've tested recently libp11 with openssl engine for cryptoauthlib, the Microchip crypto chips library, but I've not yet loaded certs into the chips (any mistake could result in a brick of the chip due the OTP feature) and, by now, I only know it compiles well and openssl engine -t works with it. So I think I can use libp11 with p11-kit in order to setup and use modules for opencriptoki and cryptoauthlib. About closing this issue, as the project's still alive and downloadable, I think it should remain opened. Regards |
|
Yes, as you can see, i leave all issues open but right now theres nobody who has time to look into it. This sub-project is maintained on a "best-can-do" basis. |
|
Hello, I post here the link to the issue opnened at libp11 project, in order to announce other people with same trouble that maybe isn't a good idea to go to that project: J.R. |
|
Hello again Patrick, I'm not an experienced C developper, also OpenSSL is so complex for me but, after bad result moving to libp11, I've decided to try to find the cause of the error. Almost everyone can easily find in e_pkcs11.c that the error is launched because This leads to the next function: I've added debug messages to the code of the above function and now I can say that is not being called when engine is loaded and initiated. As the above function is assigned in the From this point on, reading OpenSSL related stuff it seems the problem is in the OpenSSL API functions for engine calls and, maybe, could be outside of this project. So, please, could you confirm to me my above conclusion? If yes, opencryptoki could be the cause or we must point to OpenSSL 1.0.2q? Thank you & kind regards |
|
hi i just tried it with soft token and ciphers and digests were loaded correctly. My setup is as follows... engine installed in /usr/local/lib/: token correctly initialized in slot 3: my custom openssl.cnf: Does it not work for you only with tpm token or do the other tokens return the same errors ? |
|
Hello Patrick, Thanks for your feedback. I can only test with TPM token because I've not compiled the software token. It gave me compile errors the first time I compiled version 3.10.0 of opencryptoki, so I've discarded since then. I can change SLOT_ID value to set higher than 0 to see what happens. Now I remember vaguely an older bug with token in Slot 0. I've searched for but don't find now. I'll try and report the result here. |
|
Hello again, I've changed the slot to 1 and get same results. Then I've initialized the token again with solt 1, loaded a key with p11tool without problem but get same bad results too with the engine (you can see also debug messages I've added to the code): |
|
Hello, I've been reading OpenSSL engine documentation in order to be able to properly read the e_pkcs11.c file from this project and eng_ctrl.c file from OpenSSL project. Also I added more debug messages to e_pkcs11.c file in order to be able to trace initialization of engine. The problem is clear: NULL pkcs11_token is obtained after being registered and added correctly from the slot that points to it. This happened while working with opencryptoki's TPM tokens, but works well with opencryptoki's software tokens. The cause maybe is that TPM tokens are stored in a per-user basis, while the rest aren't yet. I'm wondering if the last commit done by @ifranzki in the opencryptoki project to fix lost per-user TPM tokens after I've reported an error initializing TPM tokens could be the starting point to solve this one about getting a non null token by the engine. Regards |
|
Do you include the commit which fixes the TPM token init in your tests ? If not that may be a good idea. I mean it seems to work with other tokens so it seems to be specific to TPM. |
|
Yes, of course I'm working with the version that includes the commit. If not, I wouldn't be able to do anything with the TPM token. |
|
since it seems to be opencryptoki tpm token fault, not the engine's, you could build opencryptoki with --enable-debug (-O0 -g) and run openssl engine ibmpkcs11 -t in the debugger after setting break points to the functions you identified to return NULL instead something valid (in case of other tokens). |
|
Hello Patrick, I've compiled opencryptoki with --enable-debug option and issued commands after setting OPENCRYTOKI_TRACE_LEVEL=4 environment variable. Results are next ones: Issuing: trace shows: And issuing: then trace shows: |
|
hmm looks good, no indication why SLOT_ID=0 is ignored. From your initial post: have you tried moving SLOT_ID=0 down ie ? Order make s a difference in some cases for the config file parsing. |
|
These last tests are done with next configuration of engine: opencryptoki is configured with: |
|
Hello, Has anyone been able to devote time to this case from the last entry? Thank you & Best Regards |
|
If i had your hw setup, i would use a debugger, as described in #18 (comment) . It does not seem to be reproducible with the setups we have. So its up to you to debug it. We can only assist by looking at the code and answer your questions here. From looking at the code it looks like either the SLOT_ID=0 entry is somehow ignored or it has not been read at the time digests and ciphers are querried (race). |
|
Patrick, Thank you for your answer. You're still speaking about SLOT_ID with value 0 but, as I said before in this thread, I changed the configuration to SLOT_ID = 1 in order to determine if the value 0 was problematic. So the log was captured with SLOT_ID = 1 and TPM Token configured as slot 1, and trace messages are showing slot=1. About issuing -pre SLOT_ID:1, I've done in the first place also after -pre SO_PATH:... with same results. About debugging, I can try to compile and install gdb on the target. But, as I said I'm not an experienced C developer and I'm not familiar with C debuggers. Best Regards |
Hello,
First of all, thank you for maintaining this project. I post here after solving token configuration for TPM issues in the opencryptoki repo issues section.
Having the TPM token correctly configurated and present in the SLOT 0, now I'm facing engine error complaint for not having configured SLOT_ID in openssl.cnf:
But there is properly configured as you can see below.
This is my configuration of slots in the opencryptoki library, only TPM slot is configured:
This is my configuration of engine section in the openssl.cnf:
So now I'm wondering if here is any issue with the openssl engine and TPM slots.
Thank you & best regards
J.R.
The text was updated successfully, but these errors were encountered: