ejbca-develop — Development discussions

Re: [Ejbca-develop] What's coming up in EJBCA version 6, part 1

[Christian F. <hos...@ip...>]

Hi Tomas,

one question which may arise, is upgrade from Ejbca 4.0.x to 6.x possible w/o data loss?

Cheers
Christian

Am 19.08.13 10:01, schrieb Tomas Gustavsson:
> EJBCA v6 is brewing, for release later this autumn. I have started a 

[Ejbca-develop] What's coming up in EJBCA version 6, part 1

[Tomas G. <to...@pr...>]

Hi,

EJBCA v6 is brewing, for release later this autumn. I have started a 
short blog series about what is coming up in v6. There are many exiting 
features and improvements, I can promise that.

Part 1: Crypto Token management, in GUI
http://blog.ejbca.org/2013/08/whats-new-in-ejbca-6-part-1-crypto.html

Cheers,
Tomas

[Ejbca-develop] Call for digital signature support in free PDF readers

[Markus K. <ma...@pr...>]

Hi,

Today there are good and free PDF readers available as an alternative to
the large proprietary reader [1]. One missing feature though, is support
for digital signatures.


I am reaching out on this mailing list as I know many people with
knowledge of PKI and an interest in digital signatures are available here.


There is a ticket available in Poppler [2] for implementing support for
verifying digital signatures and during the last five years some initial
patches as been developed [3]. Poppler is the PDF rendering library used
by many PDF applications such as Evince and Okular.

Recently some people has started to donate money at FreedomSponsors to
get the implementation going:
http://www.freedomsponsors.org/core/issue/319/support-for-digital-signatures


So if you want to step up and do the implementation or to support those
that will by placing a bounty at FreedomSponsors, now is a good time :)


[1] http://PDFReaders.org/
[2] http://freedesktop.org/wiki/Software/poppler/
[3] https://bugs.freedesktop.org/show_bug.cgi?id=16770
[4]
http://www.freedomsponsors.org/core/issue/319/support-for-digital-signatures


Best regards,
Markus

Re: [Ejbca-develop] Slot management with nCipher

[Manuel D. <ma...@de...>]

On Mon, Aug 12, 2013 at 9:45 AM, Daniel JAMET <Dan...@e-...> wrote:
> I sent this mail a month ago but my problem isn't resolve.
>
>
>
> I don't understand why i can't create key with clientToolBox for the
> following reason: slotListIndex is 1 but token only has 1 slots

I would guess that the first/only slot has index 0.

Hope that helps,
Manuel

[Ejbca-develop] Slot management with nCipher

[Daniel J. <Dan...@e-...>]

I sent this mail a month ago but my problem isn't resolve.



I don't understand why i can't create key with clientToolBox for the 
following reason: slotListIndex is 1 but token only has 1 slots 

ckinfo display: 

PKCS#11 library CK_INFO 
       interface version 2.01 
                   flags 0 
          manufacturerID "nCipher Corp. Ltd               " 
      libraryDescription "nCipher PKCS#11 1.71.21         " 
  implementation version 1.71 

slots[0] CK_SLOT_INFO 
         slotDescription "Racine                " 
          manufacturerID "nCipher Corp. Ltd               " 
                   flags 6 
                   flags & CKF_REMOVABLE_DEVICE 
                   flags & CKF_HW_SLOT 
        hardware version 0.00 
        firmware version 0.00 


slots[0] Token not present 
slots[1] CK_SLOT_INFO 
         slotDescription "SRV                " 
          manufacturerID "nCipher Corp. Ltd               " 
                   flags 6 
                   flags & CKF_REMOVABLE_DEVICE 
                   flags & CKF_HW_SLOT 
        hardware version 0.00 
        firmware version 0.00 


slots[1] Token not present 


I have created the file /opt/nfast/cknfastrc : 

CKNFAST_LOADSHARING=1 
CKNFAST_NO_ACCELERATOR_SLOTS=1 
CKNFAST_NO_UNWRAP=1 
CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import 
# CKNFAST_DEBUG=10 
# CKNFAST_DEBUGFILE=/tmp/nfast.debug 

the trace log is: 

2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name = 
libcknfast.so-slot1 
library = /opt/nfast/toolkits/pkcs11/libcknfast.so 
slotListIndex = 1 
attributes(*, *, *) = { 
  CKA_TOKEN = true 
} 
attributes(*, CKO_PUBLIC_KEY, *) = { 
  CKA_ENCRYPT = true 
  CKA_VERIFY = true 
  CKA_WRAP = true 
} 
attributes(*, CKO_PRIVATE_KEY, *) = { 
  CKA_PRIVATE = true 
  CKA_SENSITIVE = true 
  CKA_EXTRACTABLE = false 
  CKA_DECRYPT = true 
  CKA_SIGN = true 
  CKA_UNWRAP = true 
} 

2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools] 
{SLOT_ID=[1], 
PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so} 
2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using SUN 
PKCS11 provider: sun.security.pkcs11.SunPKCS11 
2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error 
constructing pkcs11 provider: null 
2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command 
'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null 
pkcs11 4096 defaultSRV i1' could not be executed. 
java.io.IOException: Error constructing pkcs11 provider: null 
        at 
org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908) 
        at 
org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864) 
        at 
org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51) 

        at 
org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55) 

        at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137) 
        at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290) 
        at 
org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47) 
        at 
org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40) 
        at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70) 
Caused by: java.lang.reflect.InvocationTargetException 
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
Method) 
        at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) 

        at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) 

        at java.lang.reflect.Constructor.newInstance(Constructor.java:532) 

        at 
org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905) 
        ... 8 more 
Caused by: java.security.ProviderException: Initialization failed 
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358) 
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107) 
        ... 13 more 
Caused by: java.security.ProviderException: slotListIndex is 1 but token 
only has 1 slots 
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340) 
        ... 14 more 


ckinfo give the index 1 for SRV.   How do yo explain this ? 

EJBCA 4.0.13
JBOSS 6.10

Kind regards 
Daniel JAMET
Direction DPM
Tél : +33 1 55 23 31 70 
dan...@e-...
____________________________
Société d'Exploitation de Réseaux et de Services Sécurisés
Immeuble "Le Linéa" 
1, rue du Général Leclerc
92800 PUTEAUX

Re: [Ejbca-develop] Opening the project in an IDE

[Tomas G. <to...@pr...>]

Check in wiki.EJBCA.org, there is a chapter för developers there.

Cheers,
Tomas


Marcio Pereira <mar...@gm...> skrev:
>I'm starting with JEE and encryption. And I need to open the source
>code of
>EJBCA in some IDE (netbeans, eclipse). Whenever I try to open the
>project, the
>"imports" into the ".java" files are unresolved and can not find each
>other.
>
>Please, how can I do (or fix) this? I need to open the source code to
>make some
>changes, "linking" the project files to each ohter in an IDE...
>
>Thanks for help.
>
>
>------------------------------------------------------------------------
>
>------------------------------------------------------------------------------
>Get your SQL database under version control now!
>Version control is standard for application code, but databases havent 
>caught up. So what steps can you take to put your SQL databases under 
>version control? Why should you start doing it? Read more to find out.
>http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Ejbca-develop mailing list
>Ejb...@li...
>https://lists.sourceforge.net/lists/listinfo/ejbca-develop

[Ejbca-develop] Opening the project in an IDE

[Marcio P. <mar...@gm...>]

I'm starting with JEE and encryption. And I need to open the source code of
EJBCA in some IDE (netbeans, eclipse). Whenever I try to open the project, the
"imports" into the ".java" files are unresolved and can not find each other.

Please, how can I do (or fix) this? I need to open the source code to make some
changes, "linking" the project files to each ohter in an IDE...

Thanks for help.

Re: [Ejbca-develop] Issue with key escrow and Luna HSM

[Tomas G. <to...@pr...>]

On 07/29/2013 03:13 PM, Bruno Bonfils wrote:
> On Mon 29 July, Tomas Gustavsson wrote:
>>
>> Hi Bruno,
>>
>
> Hi Tomas,
>
> thanks for you feedback.
>
>>
>> It is so that it tries to use PKCS#11 for the symmetric encryption as
>> well, not only for asymmetric. So flags on your keys do not matter.
>> Unfortunately symmetric ciphers on HSMs is a nightmare, where you have
>> to code specifically for each HSM. So this might work with another HSM,
>> but not the Luna. The solution was to use BC (soft) for the symmetric
>> session keys and asymmetric (HSM) for session key wrapping.
>>
>> This requires a later version of BC than present in EJBCA 4, something
>> that is a big task. So backporting the fix to EJBCA 4 is unfortunately
>> not an option at this point.
>>
>> You best options currently might currently be:
>> - Move to Enterprise Edition (CC certified EJBCA 5)
>> - Use soft CA keys
>> - Wait for EJBCA 6 (sometimes during autumn)
>
> It is possible to use a soft key only for key ciphering?

Unfortunately you can not mix HSM keys with Soft keys in a CA :-(

Cheers,
Tomas

Re: [Ejbca-develop] Issue with key escrow and Luna HSM

[Bruno B. <as...@as...>]

On Mon 29 July, Tomas Gustavsson wrote:
> 
> Hi Bruno,
> 

Hi Tomas,

thanks for you feedback.

> 
> It is so that it tries to use PKCS#11 for the symmetric encryption as 
> well, not only for asymmetric. So flags on your keys do not matter. 
> Unfortunately symmetric ciphers on HSMs is a nightmare, where you have 
> to code specifically for each HSM. So this might work with another HSM, 
> but not the Luna. The solution was to use BC (soft) for the symmetric 
> session keys and asymmetric (HSM) for session key wrapping.
> 
> This requires a later version of BC than present in EJBCA 4, something 
> that is a big task. So backporting the fix to EJBCA 4 is unfortunately 
> not an option at this point.
> 
> You best options currently might currently be:
> - Move to Enterprise Edition (CC certified EJBCA 5)
> - Use soft CA keys
> - Wait for EJBCA 6 (sometimes during autumn)

It is possible to use a soft key only for key ciphering?

Anyway, thanks you again.

-- 
http://asyd.net/home/    - Home Page
http://netvibes.com/asyd - Portal

Re: [Ejbca-develop] Issue with key escrow and Luna HSM

[Tomas G. <to...@pr...>]

Hi Bruno,

Since it is key recovery I think you have been bit by 
https://jira.primekey.se/browse/ECA-2739.

It is so that it tries to use PKCS#11 for the symmetric encryption as 
well, not only for asymmetric. So flags on your keys do not matter. 
Unfortunately symmetric ciphers on HSMs is a nightmare, where you have 
to code specifically for each HSM. So this might work with another HSM, 
but not the Luna. The solution was to use BC (soft) for the symmetric 
session keys and asymmetric (HSM) for session key wrapping.

This requires a later version of BC than present in EJBCA 4, something 
that is a big task. So backporting the fix to EJBCA 4 is unfortunately 
not an option at this point.

You best options currently might currently be:
- Move to Enterprise Edition (CC certified EJBCA 5)
- Use soft CA keys
- Wait for EJBCA 6 (sometimes during autumn)

Cheers,
Tomas
**********
PrimeKey Solutions AB
Anderstorpsvägen 16, 171 54 Solna, Sweden
Mob: +46 (0)707421096
Internet: www.primekey.se
Twitter: twitter.com/primekeyPKI
**********

On 07/29/2013 02:01 PM, Bruno Bonfils wrote:
> Hello,
>
> I have an exception: "No key recovery data exists for user" when I try
> to reissue a P12 keystore issued by a CA stored in a Luna HSM. The
> entity is marked as 'Key recoverable' and status is set to 'Key
> Recovery'.
>
> I also have the following error:
> "sun.security.pkcs11.wrapper.PKCS11Exception: CKR_TEMPLATE_INCONSISTENT"
>
> Here the CA PKCS11 properties:
>
> sharedLib=/usr/lunasa/lib/libCryptoki2_64.so
> slot=1
> certSignKey=key
> crlSignKey=key
> defaultKey=key
> pin=<pin code>
>
> Any help will be appreciated!
>
> Best regards
>

[Ejbca-develop] Issue with key escrow and Luna HSM

[Bruno B. <as...@as...>]

Hello,

I have an exception: "No key recovery data exists for user" when I try
to reissue a P12 keystore issued by a CA stored in a Luna HSM. The
entity is marked as 'Key recoverable' and status is set to 'Key
Recovery'.

I also have the following error:
"sun.security.pkcs11.wrapper.PKCS11Exception: CKR_TEMPLATE_INCONSISTENT"

Here the CA PKCS11 properties:

sharedLib=/usr/lunasa/lib/libCryptoki2_64.so
slot=1
certSignKey=key
crlSignKey=key
defaultKey=key
pin=<pin code>

Any help will be appreciated!

Best regards

-- 
http://asyd.net/home/    - Home Page
http://netvibes.com/asyd - Portal

Re: [Ejbca-develop] Issue with key escrow and Luna HSM

[Bruno B. <as...@as...>]

On Wed 10 July, Bruno Bonfils wrote:
> Hello,

Hi,

any idea? I thought the issue was about CKA flags like DECRYPT and
UNWRAP, but these flags are set on the private key (output of cmu):

class=privateKey
token=true
private=true
label=
keytype=RSA
subject=
id=636963612d6361
sensitive=true
decrypt=true
unwrap=true
sign=true
derive=false
startdate=
enddate=

Any help will be appreciated!

Thanks
-- 
http://asyd.net/home/    - Home Page
http://netvibes.com/asyd - Portal

Re: [Ejbca-develop] Require approval for certificate creation when sending a CSR

[Tomas G. <to...@pr...>]

Hi,

The username/password on the public web is not a login that can be shared. It is a one time enrollment code (password).

Perhaps the self registration is something for you? http://ejbca.org/adminguide.html#Self%20Registration

EJBCA can encompass almost any workflows. Most of them are not implemented directly in the gui, its too complicated for the users. If not available out of the box, you can easily implement it using the plug in mechanism.
http://ejbca.org/adminguide.html#EJBCA%20Plugins

Cheers,
Tomas


Henrik <Hen...@Go...> skrev:
>Hi Anders,
>
>Thanks for the fast response!
>
>> AFAIK there is no such function since it is only applicable to
>low-volume
>certification systems.
>
>I got a use case where it would be very convenient, even for a
>high-volume
>PKI.
>
>Actually, I'm not sure that I understand the way EJBCA is supposed to
>be
>used for server certificates.
>So every End Entity is a server, hence needs an EJBCA user with login
>credentials. But if servers are administered by more than one
>administrator
>and if these administrators change continuously (someone leaves,
>someone
>joins), it would require to share and manage login credentials for the
>EJBCA users that belong to these machines.
>
>I'm currently "solving" this by building an external RA that uses the
>SOAP
>API of EJBCA.
>However, I find myself giving the RA more and more privileges, making
>it
>too complex and powerful.
>
>What I'm currently having is an interface that allows a user to log in
>and
>see a list of all EJBCA End Entities administered by that user.
>The user can then upload a new public key (as part of a CSR) to request
>a
>cert, which sends a request to EJBCA and also opens a ticket in our
>JIRA.
>*IF* EJBCA would require approval for that new public key, an EJBCA
>admin
>could now look at the JIRA ticket, review and approve the action in
>EJBCA
>and leave the ticket number as a comment in the approval (for
>reference).
>That way, it would be clear who requested which certificate and who
>approved the action.
>Though it seems I have to rework that workflow, in case I don't want to
>build the approval step into the external application as well.
>
>How would the official/intended way of requesting and signing server
>certificates look like, for machines that can be administrated by
>multiple
>changing administrators?
>
>Kind regards,
>henrik
>
>
>
>On Mon, Jul 15, 2013 at 8:34 PM, ejbca-support
><ejb...@pr...>wrote:
>
>> On 2013-07-15 18:30, Henrik wrote:
>> > Hello,
>> >
>> > is it possible to configure EJBCA so it requires an admin to
>approve
>> certificate creation when receiving a CSR?
>> > So when an approved user requests a certificate, I want to have an
>> approval step for the public key in the CSR.
>> > (I'm not referring to the approval of the End Entity, which can be
>> configured via the certificate profile.)
>>
>> Hi,
>> AFAIK there is no such function since it is only applicable to
>low-volume
>> certification systems.
>> However, you can inspect CSRs before using them with EJBCA.
>>
>> EJBCA can though automatically test public keys with respect to
>length if
>> that is what you aim to do.
>>
>> Cheers
>> Anders
>> tech support
>>
>> >
>> > Kind regards,
>> > Henrik
>> >
>> >
>> >
>>
>------------------------------------------------------------------------------
>> > See everything from the browser to the database with AppDynamics
>> > Get end-to-end visibility with application monitoring from
>AppDynamics
>> > Isolate bottlenecks and diagnose root cause in seconds.
>> > Start your free trial of AppDynamics Pro today!
>> >
>>
>http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
>> >
>> >
>> >
>> > _______________________________________________
>> > Ejbca-develop mailing list
>> > Ejb...@li...
>> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>> >
>>
>>
>
>
>------------------------------------------------------------------------
>
>------------------------------------------------------------------------------
>See everything from the browser to the database with AppDynamics
>Get end-to-end visibility with application monitoring from AppDynamics
>Isolate bottlenecks and diagnose root cause in seconds.
>Start your free trial of AppDynamics Pro today!
>http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
>
>------------------------------------------------------------------------
>
>_______________________________________________
>Ejbca-develop mailing list
>Ejb...@li...
>https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Require approval for certificate creation when sending a CSR

[ejbca-support <ejb...@pr...>]

On 2013-07-16 11:05, Henrik wrote:
> Hi Anders,
> 
> Thanks for the fast response!
> 
>> AFAIK there is no such function since it is only applicable to low-volume certification systems.
> 
> I got a use case where it would be very convenient, even for a high-volume PKI.

Hi Henrik,

I can only speak for myself but adding tons of RA functionality to EJBCA is maybe
not the right way because RA schemes tend to be driven by local demands and associated
"business logic".  PrimeKey has developed several special-purpose RA systems and they
appear all quite different.  To configure

If you have an Android phone you may even try one of them: https://mobilepki.org/scc


> Actually, I'm not sure that I understand the way EJBCA is supposed to be used for server certificates.
> So every End Entity is a server, hence needs an EJBCA user with login credentials. But if servers are administered by more than one administrator and if these administrators change continuously (someone leaves, someone joins), it would require to share and manage login credentials for the EJBCA users that belong to these machines.

Yes, but doesn't that problem belong to any scheme requiring administrators?

> 
> I'm currently "solving" this by building an external RA that uses the SOAP API of EJBCA.
> However, I find myself giving the RA more and more privileges, making it too complex and powerful.

In most scenarios an RA needs to be able to create and optionally revoke certificates.

However, an RA does typically not have to adjust CA parameters or creating new profiles (=policies).

In most real-world usages, EJBCA administrators are more like system administrators who creates
CAs, profiles and integrates various RA stuff (and limiting access from these).


> What I'm currently having is an interface that allows a user to log in and see a list of all EJBCA End Entities administered by that user.
> The user can then upload a new public key (as part of a CSR) to request a cert, which sends a request to EJBCA and also opens a ticket in our JIRA.
> *IF* EJBCA would require approval for that new public key, an EJBCA admin could now look at the JIRA ticket, review and approve the action in EJBCA and leave the ticket number as a comment in the approval (for reference). That way, it would be clear who requested which certificate and who approved the action.
> Though it seems I have to rework that workflow, in case I don't want to build the approval step into the external application as well.
> 
> How would the official/intended way of requesting and signing server certificates look like, 
> for machines that can be administrated by multiple changing administrators?

There's no official solution but it is common having a group of trusted people who are allowed to issue
server certificates.  This is similar to having a group of administrators managing enterprise users in AD.

Cheers
Anders
tech support

> 
> Kind regards,
> henrik
> 
> 
> 
> On Mon, Jul 15, 2013 at 8:34 PM, ejbca-support <ejb...@pr... <mailto:ejb...@pr...>> wrote:
> 
>     On 2013-07-15 18:30, Henrik wrote:
>     > Hello,
>     >
>     > is it possible to configure EJBCA so it requires an admin to approve certificate creation when receiving a CSR?
>     > So when an approved user requests a certificate, I want to have an approval step for the public key in the CSR.
>     > (I'm not referring to the approval of the End Entity, which can be configured via the certificate profile.)
> 
>     Hi,
>     AFAIK there is no such function since it is only applicable to low-volume certification systems.
>     However, you can inspect CSRs before using them with EJBCA.
> 
>     EJBCA can though automatically test public keys with respect to length if that is what you aim to do.
> 
>     Cheers
>     Anders
>     tech support
> 
>     >
>     > Kind regards,
>     > Henrik
>     >
>     >
>     > ------------------------------------------------------------------------------
>     > See everything from the browser to the database with AppDynamics
>     > Get end-to-end visibility with application monitoring from AppDynamics
>     > Isolate bottlenecks and diagnose root cause in seconds.
>     > Start your free trial of AppDynamics Pro today!
>     > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
>     >
>     >
>     >
>     > _______________________________________________
>     > Ejbca-develop mailing list
>     > Ejb...@li... <mailto:Ejb...@li...>
>     > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>     >
> 
> 
> 
> 
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

Re: [Ejbca-develop] Require approval for certificate creation when sending a CSR

[Henrik <Hen...@Go...>]

Hi Anders,

Thanks for the fast response!

> AFAIK there is no such function since it is only applicable to low-volume
certification systems.

I got a use case where it would be very convenient, even for a high-volume
PKI.

Actually, I'm not sure that I understand the way EJBCA is supposed to be
used for server certificates.
So every End Entity is a server, hence needs an EJBCA user with login
credentials. But if servers are administered by more than one administrator
and if these administrators change continuously (someone leaves, someone
joins), it would require to share and manage login credentials for the
EJBCA users that belong to these machines.

I'm currently "solving" this by building an external RA that uses the SOAP
API of EJBCA.
However, I find myself giving the RA more and more privileges, making it
too complex and powerful.

What I'm currently having is an interface that allows a user to log in and
see a list of all EJBCA End Entities administered by that user.
The user can then upload a new public key (as part of a CSR) to request a
cert, which sends a request to EJBCA and also opens a ticket in our JIRA.
*IF* EJBCA would require approval for that new public key, an EJBCA admin
could now look at the JIRA ticket, review and approve the action in EJBCA
and leave the ticket number as a comment in the approval (for reference).
That way, it would be clear who requested which certificate and who
approved the action.
Though it seems I have to rework that workflow, in case I don't want to
build the approval step into the external application as well.

How would the official/intended way of requesting and signing server
certificates look like, for machines that can be administrated by multiple
changing administrators?

Kind regards,
henrik



On Mon, Jul 15, 2013 at 8:34 PM, ejbca-support <ejb...@pr...>wrote:

> On 2013-07-15 18:30, Henrik wrote:
> > Hello,
> >
> > is it possible to configure EJBCA so it requires an admin to approve
> certificate creation when receiving a CSR?
> > So when an approved user requests a certificate, I want to have an
> approval step for the public key in the CSR.
> > (I'm not referring to the approval of the End Entity, which can be
> configured via the certificate profile.)
>
> Hi,
> AFAIK there is no such function since it is only applicable to low-volume
> certification systems.
> However, you can inspect CSRs before using them with EJBCA.
>
> EJBCA can though automatically test public keys with respect to length if
> that is what you aim to do.
>
> Cheers
> Anders
> tech support
>
> >
> > Kind regards,
> > Henrik
> >
> >
> >
> ------------------------------------------------------------------------------
> > See everything from the browser to the database with AppDynamics
> > Get end-to-end visibility with application monitoring from AppDynamics
> > Isolate bottlenecks and diagnose root cause in seconds.
> > Start your free trial of AppDynamics Pro today!
> >
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> >
> >
> >
> > _______________________________________________
> > Ejbca-develop mailing list
> > Ejb...@li...
> > https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> >
>
>

Re: [Ejbca-develop] Require approval for certificate creation when sending a CSR

[ejbca-support <ejb...@pr...>]

On 2013-07-15 18:30, Henrik wrote:
> Hello,
> 
> is it possible to configure EJBCA so it requires an admin to approve certificate creation when receiving a CSR?
> So when an approved user requests a certificate, I want to have an approval step for the public key in the CSR.
> (I'm not referring to the approval of the End Entity, which can be configured via the certificate profile.)

Hi,
AFAIK there is no such function since it is only applicable to low-volume certification systems.
However, you can inspect CSRs before using them with EJBCA.

EJBCA can though automatically test public keys with respect to length if that is what you aim to do.

Cheers
Anders
tech support

> 
> Kind regards,
> Henrik
> 
> 
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> 
> 
> 
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
> 

[Ejbca-develop] Require approval for certificate creation when sending a CSR

[Henrik <Hen...@Go...>]

Hello,

is it possible to configure EJBCA so it requires an admin to approve
certificate creation when receiving a CSR?
So when an approved user requests a certificate, I want to have an approval
step for the public key in the CSR.
(I'm not referring to the approval of the End Entity, which can be
configured via the certificate profile.)

Kind regards,
Henrik

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Daniel J. <Dan...@e-...>]

Yes, I saw your dialog but My server run on CentOS 6.4 64 bits.
I don't know how nCipher manage logical and physical Slots.

Thanks for your help

Daniel JAMET
Direction DPM
Tél : +33 1 55 23 31 70 
dan...@e-...
____________________________
Société d'Exploitation de Réseaux et de Services Sécurisés
Immeuble "Le Linéa" 
1, rue du Général Leclerc
92800 PUTEAUX




De :    Juan Caracoche <ju...@re...>
A :     ejb...@li...
Date :  10/07/2013 16:09
Objet : Re: [Ejbca-develop] Slot management with ejbca and nCipher



Yesterday I set up a new CA with nCipher Edge following the Admin Guide's 
instructions with no problem. I faced the same problem than you (first 
one) and I solved using a 32bit JVM (my nCipher lib is 32bits). Then I 
could generate the keys using ClientToolbox and then I set up the CA using 
those keys. 

I did't use the HSM config file. I only configured the properties un the 
CA config page.

I hope that helps.



2013/7/10 Branko Majic <br...@ma...>
What command did you use exactly for creating the key?

On Wed, 10 Jul 2013 11:57:35 +0200
Daniel JAMET <Dan...@e-...> wrote:

> I don't understand why i can't create key with clientToolBox for the
> following reason: slotListIndex is 1 but token only has 1 slots
>
> ckinfo display:
>
> PKCS#11 library CK_INFO
>        interface version 2.01
>                    flags 0
>           manufacturerID "nCipher Corp. Ltd               "
>       libraryDescription "nCipher PKCS#11 1.71.21         "
>   implementation version 1.71
>
> slots[0] CK_SLOT_INFO
>          slotDescription "Racine                "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
>
>
> slots[0] Token not present
> slots[1] CK_SLOT_INFO
>          slotDescription "SRV                "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
>
>
> slots[1] Token not present
>
>
> I have created the file /opt/nfast/cknfastrc :
>
> CKNFAST_LOADSHARING=1
> CKNFAST_NO_ACCELERATOR_SLOTS=1
> CKNFAST_NO_UNWRAP=1
> CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
> # CKNFAST_DEBUG=10
> # CKNFAST_DEBUGFILE=/tmp/nfast.debug
>
> the trace log is:
>
> 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name =
> libcknfast.so-slot1
> library = /opt/nfast/toolkits/pkcs11/libcknfast.so
> slotListIndex = 1
> attributes(*, *, *) = {
>   CKA_TOKEN = true
> }
> attributes(*, CKO_PUBLIC_KEY, *) = {
>   CKA_ENCRYPT = true
>   CKA_VERIFY = true
>   CKA_WRAP = true
> }
> attributes(*, CKO_PRIVATE_KEY, *) = {
>   CKA_PRIVATE = true
>   CKA_SENSITIVE = true
>   CKA_EXTRACTABLE = false
>   CKA_DECRYPT = true
>   CKA_SIGN = true
>   CKA_UNWRAP = true
> }
>
> 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools]
> {SLOT_ID=[1],
> PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
> 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using 
SUN
> PKCS11 provider: sun.security.pkcs11.SunPKCS11
> 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error
> constructing pkcs11 provider: null
> 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command
> 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null
> pkcs11 4096 defaultSRV i1' could not be executed.
> java.io.IOException: Error constructing pkcs11 provider: null
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
>         at
> 
org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
>         at
> 
org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
>         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
>         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
>         at
> org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
>         at
> org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
>         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
> Caused by: java.lang.reflect.InvocationTargetException
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
>         at
> 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>         at
> 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>         at 
java.lang.reflect.Constructor.newInstance(Constructor.java:532)
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
>         ... 8 more
> Caused by: java.security.ProviderException: Initialization failed
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
>         ... 13 more
> Caused by: java.security.ProviderException: slotListIndex is 1 but token
> only has 1 slots
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
>         ... 14 more
>
>
> ckinfo give the index 1 for SRV.   How do yo explain this ?
>
> Kind regards
>
> Daniel JAMET
> Direction DPM
> Tél : +33 1 55 23 31 70
> dan...@e-...
> ____________________________
> Société d'Exploitation de Réseaux et de Services Sécurisés
> Immeuble "Le Linéa"
> 1, rue du Général Leclerc
> 92800 PUTEAUX



--
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop




-- 



Juan Caracoche | Business Developer
jua...@re...
Mobile: +54.911.4198.8941
www.redb.ee
------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Daniel J. <Dan...@e-...>]

I use these commands:

   create persistent cardset with:

         /opt/nfast/bin/createocs -Q 2/3 -N MyCardset -M -p -T 0

  create the keys with:

        1) /opt/nfast/bin/preload -c MyCardset exit
            2) /opt/nfast/bin/preload -c MyCardset 
/opt/ejbca/bin/pkcs11HSM.sh generate 
/opt/nfast/toolkits/pkcs11/libcknfast.so 4096 defaultMyCardset  iN (N is 
the slot index give by ckinfo)

Thanks for your help
 
Daniel JAMET
Direction DPM
Tél : +33 1 55 23 31 70 
dan...@e-...
____________________________
Société d'Exploitation de Réseaux et de Services Sécurisés
Immeuble "Le Linéa" 
1, rue du Général Leclerc
92800 PUTEAUX




De :    Branko Majic <br...@ma...>
A :     ejb...@li...
Date :  10/07/2013 15:22
Objet : Re: [Ejbca-develop] Slot management with ejbca and nCipher



What command did you use exactly for creating the key?

On Wed, 10 Jul 2013 11:57:35 +0200
Daniel JAMET <Dan...@e-...> wrote:

> I don't understand why i can't create key with clientToolBox for the 
> following reason: slotListIndex is 1 but token only has 1 slots
> 
> ckinfo display:
> 
> PKCS#11 library CK_INFO
>        interface version 2.01
>                    flags 0
>           manufacturerID "nCipher Corp. Ltd               "
>       libraryDescription "nCipher PKCS#11 1.71.21         "
>   implementation version 1.71
> 
> slots[0] CK_SLOT_INFO
>          slotDescription "Racine                "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
> 
> 
> slots[0] Token not present
> slots[1] CK_SLOT_INFO
>          slotDescription "SRV                "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
> 
> 
> slots[1] Token not present
> 
> 
> I have created the file /opt/nfast/cknfastrc :
> 
> CKNFAST_LOADSHARING=1
> CKNFAST_NO_ACCELERATOR_SLOTS=1
> CKNFAST_NO_UNWRAP=1
> CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
> # CKNFAST_DEBUG=10
> # CKNFAST_DEBUGFILE=/tmp/nfast.debug
> 
> the trace log is:
> 
> 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name = 
> libcknfast.so-slot1
> library = /opt/nfast/toolkits/pkcs11/libcknfast.so
> slotListIndex = 1
> attributes(*, *, *) = {
>   CKA_TOKEN = true
> }
> attributes(*, CKO_PUBLIC_KEY, *) = {
>   CKA_ENCRYPT = true
>   CKA_VERIFY = true
>   CKA_WRAP = true
> }
> attributes(*, CKO_PRIVATE_KEY, *) = {
>   CKA_PRIVATE = true
>   CKA_SENSITIVE = true
>   CKA_EXTRACTABLE = false
>   CKA_DECRYPT = true
>   CKA_SIGN = true
>   CKA_UNWRAP = true
> }
> 
> 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools] 
> {SLOT_ID=[1], 
> PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
> 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using 
SUN 
> PKCS11 provider: sun.security.pkcs11.SunPKCS11
> 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error 
> constructing pkcs11 provider: null
> 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command 
> 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null 

> pkcs11 4096 defaultSRV i1' could not be executed.
> java.io.IOException: Error constructing pkcs11 provider: null
>         at 
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
>         at 
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
>         at 
> 
org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
>         at 
> 
org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
>         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
>         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
>         at 
> org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
>         at 
> org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
>         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
> Caused by: java.lang.reflect.InvocationTargetException
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 

> Method)
>         at 
> 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>         at 
> 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>         at 
java.lang.reflect.Constructor.newInstance(Constructor.java:532)
>         at 
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
>         ... 8 more
> Caused by: java.security.ProviderException: Initialization failed
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
>         ... 13 more
> Caused by: java.security.ProviderException: slotListIndex is 1 but token 

> only has 1 slots
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
>         ... 14 more
> 
> 
> ckinfo give the index 1 for SRV.   How do yo explain this ?
> 
> Kind regards
> 
> Daniel JAMET
> Direction DPM
> Tél : +33 1 55 23 31 70 
> dan...@e-...
> ____________________________
> Société d'Exploitation de Réseaux et de Services Sécurisés
> Immeuble "Le Linéa" 
> 1, rue du Général Leclerc
> 92800 PUTEAUX



-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.
[pièce jointe "signature.asc" supprimée par Daniel JAMET/SER2S] 
------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Juan C. <ju...@re...>]

Yesterday I set up a new CA with nCipher Edge following the Admin Guide's
instructions with no problem. I faced the same problem than you (first one)
and I solved using a 32bit JVM (my nCipher lib is 32bits). Then I could
generate the keys using ClientToolbox and then I set up the CA using those
keys.

I did't use the HSM config file. I only configured the properties un the CA
config page.

I hope that helps.



2013/7/10 Branko Majic <br...@ma...>

> What command did you use exactly for creating the key?
>
> On Wed, 10 Jul 2013 11:57:35 +0200
> Daniel JAMET <Dan...@e-...> wrote:
>
> > I don't understand why i can't create key with clientToolBox for the
> > following reason: slotListIndex is 1 but token only has 1 slots
> >
> > ckinfo display:
> >
> > PKCS#11 library CK_INFO
> >        interface version 2.01
> >                    flags 0
> >           manufacturerID "nCipher Corp. Ltd               "
> >       libraryDescription "nCipher PKCS#11 1.71.21         "
> >   implementation version 1.71
> >
> > slots[0] CK_SLOT_INFO
> >          slotDescription "Racine                "
> >           manufacturerID "nCipher Corp. Ltd               "
> >                    flags 6
> >                    flags & CKF_REMOVABLE_DEVICE
> >                    flags & CKF_HW_SLOT
> >         hardware version 0.00
> >         firmware version 0.00
> >
> >
> > slots[0] Token not present
> > slots[1] CK_SLOT_INFO
> >          slotDescription "SRV                "
> >           manufacturerID "nCipher Corp. Ltd               "
> >                    flags 6
> >                    flags & CKF_REMOVABLE_DEVICE
> >                    flags & CKF_HW_SLOT
> >         hardware version 0.00
> >         firmware version 0.00
> >
> >
> > slots[1] Token not present
> >
> >
> > I have created the file /opt/nfast/cknfastrc :
> >
> > CKNFAST_LOADSHARING=1
> > CKNFAST_NO_ACCELERATOR_SLOTS=1
> > CKNFAST_NO_UNWRAP=1
> > CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
> > # CKNFAST_DEBUG=10
> > # CKNFAST_DEBUGFILE=/tmp/nfast.debug
> >
> > the trace log is:
> >
> > 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name =
> > libcknfast.so-slot1
> > library = /opt/nfast/toolkits/pkcs11/libcknfast.so
> > slotListIndex = 1
> > attributes(*, *, *) = {
> >   CKA_TOKEN = true
> > }
> > attributes(*, CKO_PUBLIC_KEY, *) = {
> >   CKA_ENCRYPT = true
> >   CKA_VERIFY = true
> >   CKA_WRAP = true
> > }
> > attributes(*, CKO_PRIVATE_KEY, *) = {
> >   CKA_PRIVATE = true
> >   CKA_SENSITIVE = true
> >   CKA_EXTRACTABLE = false
> >   CKA_DECRYPT = true
> >   CKA_SIGN = true
> >   CKA_UNWRAP = true
> > }
> >
> > 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools]
> > {SLOT_ID=[1],
> > PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
> > 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using
> SUN
> > PKCS11 provider: sun.security.pkcs11.SunPKCS11
> > 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error
> > constructing pkcs11 provider: null
> > 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command
> > 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null
> > pkcs11 4096 defaultSRV i1' could not be executed.
> > java.io.IOException: Error constructing pkcs11 provider: null
> >         at
> > org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
> >         at
> > org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
> >         at
> >
> org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
> >         at
> >
> org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
> >         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
> >         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
> >         at
> > org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
> >         at
> > org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
> >         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
> > Caused by: java.lang.reflect.InvocationTargetException
> >         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> > Method)
> >         at
> >
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
> >         at
> >
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
> >         at
> java.lang.reflect.Constructor.newInstance(Constructor.java:532)
> >         at
> > org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
> >         ... 8 more
> > Caused by: java.security.ProviderException: Initialization failed
> >         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
> >         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
> >         ... 13 more
> > Caused by: java.security.ProviderException: slotListIndex is 1 but token
> > only has 1 slots
> >         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
> >         ... 14 more
> >
> >
> > ckinfo give the index 1 for SRV.   How do yo explain this ?
> >
> > Kind regards
> >
> > Daniel JAMET
> > Direction DPM
> > Tél : +33 1 55 23 31 70
> > dan...@e-...
> > ____________________________
> > Société d'Exploitation de Réseaux et de Services Sécurisés
> > Immeuble "Le Linéa"
> > 1, rue du Général Leclerc
> > 92800 PUTEAUX
>
>
>
> --
> Branko Majic
> Jabber: br...@ma...
> Please use only Free formats when sending attachments to me.
>
> Бранко Мајић
> Џабер: br...@ma...
> Молим вас да додатке шаљете искључиво у слободним форматима.
>
>
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>
>


-- 



Juan Caracoche | Business Developer
jua...@re...
Mobile: +54.911.4198.8941
www.redb.ee

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Branko M. <br...@ma...>]

What command did you use exactly for creating the key?

On Wed, 10 Jul 2013 11:57:35 +0200
Daniel JAMET <Dan...@e-...> wrote:

> I don't understand why i can't create key with clientToolBox for the 
> following reason: slotListIndex is 1 but token only has 1 slots
> 
> ckinfo display:
> 
> PKCS#11 library CK_INFO
>        interface version 2.01
>                    flags 0
>           manufacturerID "nCipher Corp. Ltd               "
>       libraryDescription "nCipher PKCS#11 1.71.21         "
>   implementation version 1.71
> 
> slots[0] CK_SLOT_INFO
>          slotDescription "Racine                "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
> 
> 
> slots[0] Token not present
> slots[1] CK_SLOT_INFO
>          slotDescription "SRV                "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
> 
> 
> slots[1] Token not present
> 
> 
> I have created the file /opt/nfast/cknfastrc :
> 
> CKNFAST_LOADSHARING=1
> CKNFAST_NO_ACCELERATOR_SLOTS=1
> CKNFAST_NO_UNWRAP=1
> CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
> # CKNFAST_DEBUG=10
> # CKNFAST_DEBUGFILE=/tmp/nfast.debug
> 
> the trace log is:
> 
> 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name = 
> libcknfast.so-slot1
> library = /opt/nfast/toolkits/pkcs11/libcknfast.so
> slotListIndex = 1
> attributes(*, *, *) = {
>   CKA_TOKEN = true
> }
> attributes(*, CKO_PUBLIC_KEY, *) = {
>   CKA_ENCRYPT = true
>   CKA_VERIFY = true
>   CKA_WRAP = true
> }
> attributes(*, CKO_PRIVATE_KEY, *) = {
>   CKA_PRIVATE = true
>   CKA_SENSITIVE = true
>   CKA_EXTRACTABLE = false
>   CKA_DECRYPT = true
>   CKA_SIGN = true
>   CKA_UNWRAP = true
> }
> 
> 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools] 
> {SLOT_ID=[1], 
> PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
> 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using SUN 
> PKCS11 provider: sun.security.pkcs11.SunPKCS11
> 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error 
> constructing pkcs11 provider: null
> 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command 
> 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null 
> pkcs11 4096 defaultSRV i1' could not be executed.
> java.io.IOException: Error constructing pkcs11 provider: null
>         at 
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
>         at 
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
>         at 
> org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
>         at 
> org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
>         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
>         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
>         at 
> org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
>         at 
> org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
>         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
> Caused by: java.lang.reflect.InvocationTargetException
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
> Method)
>         at 
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>         at 
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>         at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
>         at 
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
>         ... 8 more
> Caused by: java.security.ProviderException: Initialization failed
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
>         ... 13 more
> Caused by: java.security.ProviderException: slotListIndex is 1 but token 
> only has 1 slots
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
>         ... 14 more
> 
> 
> ckinfo give the index 1 for SRV.   How do yo explain this ?
> 
> Kind regards
> 
> Daniel JAMET
> Direction DPM
> Tél : +33 1 55 23 31 70 
> dan...@e-...
> ____________________________
> Société d'Exploitation de Réseaux et de Services Sécurisés
> Immeuble "Le Linéa" 
> 1, rue du Général Leclerc
> 92800 PUTEAUX



-- 
Branko Majic
Jabber: br...@ma...
Please use only Free formats when sending attachments to me.

Бранко Мајић
Џабер: br...@ma...
Молим вас да додатке шаљете искључиво у слободним форматима.

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Daniel J. <Dan...@e-...>]

No.
The keys are generated but not usable with EJBCA for crate an CA.

thanks,

Daniel JAMET
Direction DPM
Tél : +33 1 55 23 31 70 
dan...@e-...
____________________________
Société d'Exploitation de Réseaux et de Services Sécurisés
Immeuble "Le Linéa" 
1, rue du Général Leclerc
92800 PUTEAUX




De :    Manuel Dejonghe <ma...@de...>
A :     ejbca-develop <ejb...@li...>
Date :  10/07/2013 13:29
Objet : Re: [Ejbca-develop] Slot management with ejbca and nCipher



So the initial problem is solved now ?

I am even much less likely to be able help with your next problem.

sorry,
Manuel

On Wed, Jul 10, 2013 at 1:08 PM, Daniel JAMET <Dan...@e-...> 
wrote:
> Hi Manuel,
>
> Yes I have all seems to be OK. I have generated three keys: defaultSRV,
> cryptSRV and cryptSRV.
>
> When I create an AC, I have no key corresponding with these aliases and 
i
> obtain the log you can see below:
>
> 2013-07-09 14:05:51,511 DEBUG
> [org.ejbca.core.model.ca.catoken.CATokenContainerImpl]
> (WorkerThread#0[127.0.0.1:51200]) CA Token is CATOKENTYPE_HSM
> 2013-07-09 14:05:51,511 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) >init: sSlotLabelKey=slot,
> Signaturealg=SHA1WithRSA
> 2013-07-09 14:05:51,511 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Prop: {hardTokenEncrypt=cryptSRV,
> sharedLibrary=/opt/nfast/toolkits/pkcs11/libcknfast.so, pin=hidden,
> defaultKey=defaultSRV, slotListIndex=0 , keyEncryptKey=cryptSRV,
> testKey=testSRV}
> 2013-07-09 14:05:51,512 DEBUG [org.ejbca.util.CryptoProviderTools]
> (WorkerThread#0[127.0.0.1:51200]) MaxAllowedKeyLength for DES is: 
2147483647
> 2013-07-09 14:05:51,512 DEBUG [org.ejbca.util.StringTools]
> (WorkerThread#0[127.0.0.1:51200]) Using cleartext autoactivation pin
> 2013-07-09 14:05:51,512 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) <init: sSlotLabelKey=slot,
> Signaturealg=SHA1WithRSA
> 2013-07-09 14:05:51,514 DEBUG
> [org.ejbca.core.model.ca.catoken.PKCS11CAToken]
> (WorkerThread#0[127.0.0.1:51200]) Loading key from slot '0' using pin.
> 2013-07-09 14:05:51,515 ERROR 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias
> 'defaultSRV' from keystore, got null. If the key was generated after the
> latest application server start then restart the application server.
> 2013-07-09 14:05:51,515 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
> 2013-07-09 14:05:51,515 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
> 2013-07-09 14:05:51,515 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
> 2013-07-09 14:05:51,515 ERROR 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias
> 'cryptSRV' from keystore, got null. If the key was generated after the
> latest application server start then restart the application server.
> 2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
> 2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
> 2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
> 2013-07-09 14:05:51,516 ERROR 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias
> 'testSRV' from keystore, got null. If the key was generated after the 
latest
> application server start then restart the application server.
> 2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
> 2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
> 2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
> 2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Testing keys with alias defaultSRV
> 2013-07-09 14:05:51,516 INFO 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) No keys with alias defaultSRV exists.
> 2013-07-09 14:05:51,517 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Testing keys with alias cryptSRV
> 2013-07-09 14:05:51,517 INFO 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) No keys with alias cryptSRV exists.
> 2013-07-09 14:05:51,517 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Testing keys with alias testSRV
> 2013-07-09 14:05:51,517 INFO 
[org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) No keys with alias testSRV exists.
> 2013-07-09 14:05:51,518 ERROR
> [org.ejbca.core.model.ca.catoken.PKCS11CAToken]
> (WorkerThread#0[127.0.0.1:51200]) Failed to initialize PKCS11 provider 
slot
> '0'.
>
>
> Kind regards
>
> Daniel JAMET
> Direction DPM
> Tél : +33 1 55 23 31 70
> dan...@e-...
> ____________________________
> Société d'Exploitation de Réseaux et de Services Sécurisés
> Immeuble "Le Linéa"
> 1, rue du Général Leclerc
> 92800 PUTEAUX
>
>
>
>
> De :        Manuel Dejonghe <ma...@de...>
> A :        ejb...@li...
> Date :        10/07/2013 12:05
> Objet :        Re: [Ejbca-develop] Slot management with ejbca and 
nCipher
> ________________________________
>
>
>
> Hi Daniel,
> I must say that I have no knowledge about nCipher, and my idea might
> be very stupid, but have you maybe tried to do the operation on
> slotIndex 0 ?
>
> hope that helps,
> Manuel
>
> On Wed, Jul 10, 2013 at 11:57 AM, Daniel JAMET <Dan...@e-...>
> wrote:
>> I don't understand why i can't create key with clientToolBox for the
>> following reason: slotListIndex is 1 but token only has 1 slots
>>
>> ckinfo display:
>>
>> PKCS#11 library CK_INFO
>>        interface version 2.01
>>                    flags 0
>>           manufacturerID "nCipher Corp. Ltd               "
>>       libraryDescription "nCipher PKCS#11 1.71.21         "
>>   implementation version 1.71
>>
>> slots[0] CK_SLOT_INFO
>>          slotDescription "Racine
>> "
>>           manufacturerID "nCipher Corp. Ltd               "
>>                    flags 6
>>                    flags & CKF_REMOVABLE_DEVICE
>>                    flags & CKF_HW_SLOT
>>         hardware version 0.00
>>         firmware version 0.00
>>
>>
>> slots[0] Token not present
>> slots[1] CK_SLOT_INFO
>>          slotDescription "SRV
>> "
>>           manufacturerID "nCipher Corp. Ltd               "
>>                    flags 6
>>                    flags & CKF_REMOVABLE_DEVICE
>>                    flags & CKF_HW_SLOT
>>         hardware version 0.00
>>         firmware version 0.00
>>
>>
>> slots[1] Token not present
>>
>>
>> I have created the file /opt/nfast/cknfastrc :
>>
>> CKNFAST_LOADSHARING=1
>> CKNFAST_NO_ACCELERATOR_SLOTS=1
>> CKNFAST_NO_UNWRAP=1
>> CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
>> # CKNFAST_DEBUG=10
>> # CKNFAST_DEBUGFILE=/tmp/nfast.debug
>>
>> the trace log is:
>>
>> 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name =
>> libcknfast.so-slot1
>> library = /opt/nfast/toolkits/pkcs11/libcknfast.so
>> slotListIndex = 1
>> attributes(*, *, *) = {
>>   CKA_TOKEN = true
>> }
>> attributes(*, CKO_PUBLIC_KEY, *) = {
>>   CKA_ENCRYPT = true
>>   CKA_VERIFY = true
>>   CKA_WRAP = true
>> }
>> attributes(*, CKO_PRIVATE_KEY, *) = {
>>   CKA_PRIVATE = true
>>   CKA_SENSITIVE = true
>>   CKA_EXTRACTABLE = false
>>   CKA_DECRYPT = true
>>   CKA_SIGN = true
>>   CKA_UNWRAP = true
>> }
>>
>> 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools]
>> {SLOT_ID=[1],
>> PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
>> 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using 
SUN
>> PKCS11 provider: sun.security.pkcs11.SunPKCS11
>> 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error
>> constructing pkcs11 provider: null
>> 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command
>> 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so 
null
>> pkcs11 4096 defaultSRV i1' could not be executed.
>> java.io.IOException: Error constructing pkcs11 provider: null
>>         at
>> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
>>         at
>> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
>>         at
>>
>> 
org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
>>         at
>>
>> 
org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
>>         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
>>         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
>>         at
>> org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
>>         at
>> org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
>>         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
>> Caused by: java.lang.reflect.InvocationTargetException
>>         at 
sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
>> Method)
>>         at
>>
>> 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>>         at
>>
>> 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>>         at 
java.lang.reflect.Constructor.newInstance(Constructor.java:532)
>>         at
>> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
>>         ... 8 more
>> Caused by: java.security.ProviderException: Initialization failed
>>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
>>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
>>         ... 13 more
>> Caused by: java.security.ProviderException: slotListIndex is 1 but 
token
>> only has 1 slots
>>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
>>         ... 14 more
>>
>>
>> ckinfo give the index 1 for SRV.   How do yo explain this ?
>>
>> Kind regards
>>
>> Daniel JAMET
>> Direction DPM
>> Tél : +33 1 55 23 31 70
>> dan...@e-...
>> ____________________________
>> Société d'Exploitation de Réseaux et de Services Sécurisés
>> Immeuble "Le Linéa"
>> 1, rue du Général Leclerc
>> 92800 PUTEAUX
>>
>>
>> 
------------------------------------------------------------------------------
>> See everything from the browser to the database with AppDynamics
>> Get end-to-end visibility with application monitoring from AppDynamics
>> Isolate bottlenecks and diagnose root cause in seconds.
>> Start your free trial of AppDynamics Pro today!
>>
>> 
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
> 
------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> 
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Manuel D. <ma...@de...>]

So the initial problem is solved now ?

I am even much less likely to be able help with your next problem.

sorry,
Manuel

On Wed, Jul 10, 2013 at 1:08 PM, Daniel JAMET <Dan...@e-...> wrote:
> Hi Manuel,
>
> Yes I have all seems to be OK. I have generated three keys: defaultSRV,
> cryptSRV and cryptSRV.
>
> When I create an AC, I have no key corresponding with these aliases and i
> obtain the log you can see below:
>
> 2013-07-09 14:05:51,511 DEBUG
> [org.ejbca.core.model.ca.catoken.CATokenContainerImpl]
> (WorkerThread#0[127.0.0.1:51200]) CA Token is CATOKENTYPE_HSM
> 2013-07-09 14:05:51,511 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) >init: sSlotLabelKey=slot,
> Signaturealg=SHA1WithRSA
> 2013-07-09 14:05:51,511 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Prop: {hardTokenEncrypt=cryptSRV,
> sharedLibrary=/opt/nfast/toolkits/pkcs11/libcknfast.so, pin=hidden,
> defaultKey=defaultSRV, slotListIndex=0 , keyEncryptKey=cryptSRV,
> testKey=testSRV}
> 2013-07-09 14:05:51,512 DEBUG [org.ejbca.util.CryptoProviderTools]
> (WorkerThread#0[127.0.0.1:51200]) MaxAllowedKeyLength for DES is: 2147483647
> 2013-07-09 14:05:51,512 DEBUG [org.ejbca.util.StringTools]
> (WorkerThread#0[127.0.0.1:51200]) Using cleartext autoactivation pin
> 2013-07-09 14:05:51,512 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) <init: sSlotLabelKey=slot,
> Signaturealg=SHA1WithRSA
> 2013-07-09 14:05:51,514 DEBUG
> [org.ejbca.core.model.ca.catoken.PKCS11CAToken]
> (WorkerThread#0[127.0.0.1:51200]) Loading key from slot '0' using pin.
> 2013-07-09 14:05:51,515 ERROR [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias
> 'defaultSRV' from keystore, got null. If the key was generated after the
> latest application server start then restart the application server.
> 2013-07-09 14:05:51,515 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
> 2013-07-09 14:05:51,515 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
> 2013-07-09 14:05:51,515 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
> 2013-07-09 14:05:51,515 ERROR [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias
> 'cryptSRV' from keystore, got null. If the key was generated after the
> latest application server start then restart the application server.
> 2013-07-09 14:05:51,516 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
> 2013-07-09 14:05:51,516 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
> 2013-07-09 14:05:51,516 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
> 2013-07-09 14:05:51,516 ERROR [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias
> 'testSRV' from keystore, got null. If the key was generated after the latest
> application server start then restart the application server.
> 2013-07-09 14:05:51,516 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
> 2013-07-09 14:05:51,516 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
> 2013-07-09 14:05:51,516 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
> 2013-07-09 14:05:51,516 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Testing keys with alias defaultSRV
> 2013-07-09 14:05:51,516 INFO  [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) No keys with alias defaultSRV exists.
> 2013-07-09 14:05:51,517 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Testing keys with alias cryptSRV
> 2013-07-09 14:05:51,517 INFO  [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) No keys with alias cryptSRV exists.
> 2013-07-09 14:05:51,517 DEBUG [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) Testing keys with alias testSRV
> 2013-07-09 14:05:51,517 INFO  [org.ejbca.core.model.ca.catoken.BaseCAToken]
> (WorkerThread#0[127.0.0.1:51200]) No keys with alias testSRV exists.
> 2013-07-09 14:05:51,518 ERROR
> [org.ejbca.core.model.ca.catoken.PKCS11CAToken]
> (WorkerThread#0[127.0.0.1:51200]) Failed to initialize PKCS11 provider slot
> '0'.
>
>
> Kind regards
>
> Daniel JAMET
> Direction DPM
> Tél : +33 1 55 23 31 70
> dan...@e-...
> ____________________________
> Société d'Exploitation de Réseaux et de Services Sécurisés
> Immeuble "Le Linéa"
> 1, rue du Général Leclerc
> 92800 PUTEAUX
>
>
>
>
> De :        Manuel Dejonghe <ma...@de...>
> A :        ejb...@li...
> Date :        10/07/2013 12:05
> Objet :        Re: [Ejbca-develop] Slot management with ejbca and nCipher
> ________________________________
>
>
>
> Hi Daniel,
> I must say that I have no knowledge about nCipher, and my idea might
> be very stupid, but have you maybe tried to do the operation on
> slotIndex 0 ?
>
> hope that helps,
> Manuel
>
> On Wed, Jul 10, 2013 at 11:57 AM, Daniel JAMET <Dan...@e-...>
> wrote:
>> I don't understand why i can't create key with clientToolBox for the
>> following reason: slotListIndex is 1 but token only has 1 slots
>>
>> ckinfo display:
>>
>> PKCS#11 library CK_INFO
>>        interface version 2.01
>>                    flags 0
>>           manufacturerID "nCipher Corp. Ltd               "
>>       libraryDescription "nCipher PKCS#11 1.71.21         "
>>   implementation version 1.71
>>
>> slots[0] CK_SLOT_INFO
>>          slotDescription "Racine
>> "
>>           manufacturerID "nCipher Corp. Ltd               "
>>                    flags 6
>>                    flags & CKF_REMOVABLE_DEVICE
>>                    flags & CKF_HW_SLOT
>>         hardware version 0.00
>>         firmware version 0.00
>>
>>
>> slots[0] Token not present
>> slots[1] CK_SLOT_INFO
>>          slotDescription "SRV
>> "
>>           manufacturerID "nCipher Corp. Ltd               "
>>                    flags 6
>>                    flags & CKF_REMOVABLE_DEVICE
>>                    flags & CKF_HW_SLOT
>>         hardware version 0.00
>>         firmware version 0.00
>>
>>
>> slots[1] Token not present
>>
>>
>> I have created the file /opt/nfast/cknfastrc :
>>
>> CKNFAST_LOADSHARING=1
>> CKNFAST_NO_ACCELERATOR_SLOTS=1
>> CKNFAST_NO_UNWRAP=1
>> CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
>> # CKNFAST_DEBUG=10
>> # CKNFAST_DEBUGFILE=/tmp/nfast.debug
>>
>> the trace log is:
>>
>> 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name =
>> libcknfast.so-slot1
>> library = /opt/nfast/toolkits/pkcs11/libcknfast.so
>> slotListIndex = 1
>> attributes(*, *, *) = {
>>   CKA_TOKEN = true
>> }
>> attributes(*, CKO_PUBLIC_KEY, *) = {
>>   CKA_ENCRYPT = true
>>   CKA_VERIFY = true
>>   CKA_WRAP = true
>> }
>> attributes(*, CKO_PRIVATE_KEY, *) = {
>>   CKA_PRIVATE = true
>>   CKA_SENSITIVE = true
>>   CKA_EXTRACTABLE = false
>>   CKA_DECRYPT = true
>>   CKA_SIGN = true
>>   CKA_UNWRAP = true
>> }
>>
>> 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools]
>> {SLOT_ID=[1],
>> PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
>> 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using SUN
>> PKCS11 provider: sun.security.pkcs11.SunPKCS11
>> 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error
>> constructing pkcs11 provider: null
>> 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command
>> 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null
>> pkcs11 4096 defaultSRV i1' could not be executed.
>> java.io.IOException: Error constructing pkcs11 provider: null
>>         at
>> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
>>         at
>> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
>>         at
>>
>> org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
>>         at
>>
>> org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
>>         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
>>         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
>>         at
>> org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
>>         at
>> org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
>>         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
>> Caused by: java.lang.reflect.InvocationTargetException
>>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
>> Method)
>>         at
>>
>> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>>         at
>>
>> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>>         at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
>>         at
>> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
>>         ... 8 more
>> Caused by: java.security.ProviderException: Initialization failed
>>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
>>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
>>         ... 13 more
>> Caused by: java.security.ProviderException: slotListIndex is 1 but token
>> only has 1 slots
>>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
>>         ... 14 more
>>
>>
>> ckinfo give the index 1 for SRV.   How do yo explain this ?
>>
>> Kind regards
>>
>> Daniel JAMET
>> Direction DPM
>> Tél : +33 1 55 23 31 70
>> dan...@e-...
>> ____________________________
>> Société d'Exploitation de Réseaux et de Services Sécurisés
>> Immeuble "Le Linéa"
>> 1, rue du Général Leclerc
>> 92800 PUTEAUX
>>
>>
>> ------------------------------------------------------------------------------
>> See everything from the browser to the database with AppDynamics
>> Get end-to-end visibility with application monitoring from AppDynamics
>> Isolate bottlenecks and diagnose root cause in seconds.
>> Start your free trial of AppDynamics Pro today!
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Ejbca-develop mailing list
>> Ejb...@li...
>> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>>
>
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Daniel J. <Dan...@e-...>]

Hi Manuel,

Yes I have all seems to be OK. I have generated three keys: defaultSRV, 
cryptSRV and cryptSRV.

When I create an AC, I have no key corresponding with these aliases and i 
obtain the log you can see below:

2013-07-09 14:05:51,511 DEBUG 
[org.ejbca.core.model.ca.catoken.CATokenContainerImpl] 
(WorkerThread#0[127.0.0.1:51200]) CA Token is CATOKENTYPE_HSM
2013-07-09 14:05:51,511 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) >init: sSlotLabelKey=slot, 
Signaturealg=SHA1WithRSA
2013-07-09 14:05:51,511 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Prop: {hardTokenEncrypt=cryptSRV, 
sharedLibrary=/opt/nfast/toolkits/pkcs11/libcknfast.so, pin=hidden, 
defaultKey=defaultSRV, slotListIndex=0 , keyEncryptKey=cryptSRV, 
testKey=testSRV}
2013-07-09 14:05:51,512 DEBUG [org.ejbca.util.CryptoProviderTools] 
(WorkerThread#0[127.0.0.1:51200]) MaxAllowedKeyLength for DES is: 
2147483647
2013-07-09 14:05:51,512 DEBUG [org.ejbca.util.StringTools] 
(WorkerThread#0[127.0.0.1:51200]) Using cleartext autoactivation pin
2013-07-09 14:05:51,512 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) <init: sSlotLabelKey=slot, 
Signaturealg=SHA1WithRSA
2013-07-09 14:05:51,514 DEBUG 
[org.ejbca.core.model.ca.catoken.PKCS11CAToken] 
(WorkerThread#0[127.0.0.1:51200]) Loading key from slot '0' using pin.
2013-07-09 14:05:51,515 ERROR 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias 
'defaultSRV' from keystore, got null. If the key was generated after the 
latest application server start then restart the application server.
2013-07-09 14:05:51,515 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
2013-07-09 14:05:51,515 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
2013-07-09 14:05:51,515 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
2013-07-09 14:05:51,515 ERROR 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias 
'cryptSRV' from keystore, got null. If the key was generated after the 
latest application server start then restart the application server.
2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
2013-07-09 14:05:51,516 ERROR 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Can not read private key with alias 
'testSRV' from keystore, got null. If the key was generated after the 
latest application server start then restart the application server.
2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: defaultSRV
2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: cryptSRV
2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Existing alias: testSRV
2013-07-09 14:05:51,516 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Testing keys with alias defaultSRV
2013-07-09 14:05:51,516 INFO [org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) No keys with alias defaultSRV exists.
2013-07-09 14:05:51,517 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Testing keys with alias cryptSRV
2013-07-09 14:05:51,517 INFO [org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) No keys with alias cryptSRV exists.
2013-07-09 14:05:51,517 DEBUG 
[org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) Testing keys with alias testSRV
2013-07-09 14:05:51,517 INFO [org.ejbca.core.model.ca.catoken.BaseCAToken] 
(WorkerThread#0[127.0.0.1:51200]) No keys with alias testSRV exists.
2013-07-09 14:05:51,518 ERROR 
[org.ejbca.core.model.ca.catoken.PKCS11CAToken] 
(WorkerThread#0[127.0.0.1:51200]) Failed to initialize PKCS11 provider 
slot '0'.


Kind regards

Daniel JAMET
Direction DPM
Tél : +33 1 55 23 31 70 
dan...@e-...
____________________________
Société d'Exploitation de Réseaux et de Services Sécurisés
Immeuble "Le Linéa" 
1, rue du Général Leclerc
92800 PUTEAUX




De :    Manuel Dejonghe <ma...@de...>
A :     ejb...@li...
Date :  10/07/2013 12:05
Objet : Re: [Ejbca-develop] Slot management with ejbca and nCipher



Hi Daniel,
I must say that I have no knowledge about nCipher, and my idea might
be very stupid, but have you maybe tried to do the operation on
slotIndex 0 ?

hope that helps,
Manuel

On Wed, Jul 10, 2013 at 11:57 AM, Daniel JAMET <Dan...@e-...> 
wrote:
> I don't understand why i can't create key with clientToolBox for the
> following reason: slotListIndex is 1 but token only has 1 slots
>
> ckinfo display:
>
> PKCS#11 library CK_INFO
>        interface version 2.01
>                    flags 0
>           manufacturerID "nCipher Corp. Ltd               "
>       libraryDescription "nCipher PKCS#11 1.71.21         "
>   implementation version 1.71
>
> slots[0] CK_SLOT_INFO
>          slotDescription "Racine
> "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
>
>
> slots[0] Token not present
> slots[1] CK_SLOT_INFO
>          slotDescription "SRV
> "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
>
>
> slots[1] Token not present
>
>
> I have created the file /opt/nfast/cknfastrc :
>
> CKNFAST_LOADSHARING=1
> CKNFAST_NO_ACCELERATOR_SLOTS=1
> CKNFAST_NO_UNWRAP=1
> CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
> # CKNFAST_DEBUG=10
> # CKNFAST_DEBUGFILE=/tmp/nfast.debug
>
> the trace log is:
>
> 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name =
> libcknfast.so-slot1
> library = /opt/nfast/toolkits/pkcs11/libcknfast.so
> slotListIndex = 1
> attributes(*, *, *) = {
>   CKA_TOKEN = true
> }
> attributes(*, CKO_PUBLIC_KEY, *) = {
>   CKA_ENCRYPT = true
>   CKA_VERIFY = true
>   CKA_WRAP = true
> }
> attributes(*, CKO_PRIVATE_KEY, *) = {
>   CKA_PRIVATE = true
>   CKA_SENSITIVE = true
>   CKA_EXTRACTABLE = false
>   CKA_DECRYPT = true
>   CKA_SIGN = true
>   CKA_UNWRAP = true
> }
>
> 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools]
> {SLOT_ID=[1], 
PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
> 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using 
SUN
> PKCS11 provider: sun.security.pkcs11.SunPKCS11
> 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error
> constructing pkcs11 provider: null
> 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command
> 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null
> pkcs11 4096 defaultSRV i1' could not be executed.
> java.io.IOException: Error constructing pkcs11 provider: null
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
>         at
> 
org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
>         at
> 
org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
>         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
>         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
>         at
> org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
>         at
> org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
>         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
> Caused by: java.lang.reflect.InvocationTargetException
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
>         at
> 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>         at
> 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>         at 
java.lang.reflect.Constructor.newInstance(Constructor.java:532)
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
>         ... 8 more
> Caused by: java.security.ProviderException: Initialization failed
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
>         ... 13 more
> Caused by: java.security.ProviderException: slotListIndex is 1 but token
> only has 1 slots
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
>         ... 14 more
>
>
> ckinfo give the index 1 for SRV.   How do yo explain this ?
>
> Kind regards
>
> Daniel JAMET
> Direction DPM
> Tél : +33 1 55 23 31 70
> dan...@e-...
> ____________________________
> Société d'Exploitation de Réseaux et de Services Sécurisés
> Immeuble "Le Linéa"
> 1, rue du Général Leclerc
> 92800 PUTEAUX
>
> 
------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> 
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>

------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

_______________________________________________
Ejbca-develop mailing list
Ejb...@li...
https://lists.sourceforge.net/lists/listinfo/ejbca-develop

Re: [Ejbca-develop] Slot management with ejbca and nCipher

[Manuel D. <ma...@de...>]

Hi Daniel,
I must say that I have no knowledge about nCipher, and my idea might
be very stupid, but have you maybe tried to do the operation on
slotIndex 0 ?

hope that helps,
Manuel

On Wed, Jul 10, 2013 at 11:57 AM, Daniel JAMET <Dan...@e-...> wrote:
> I don't understand why i can't create key with clientToolBox for the
> following reason: slotListIndex is 1 but token only has 1 slots
>
> ckinfo display:
>
> PKCS#11 library CK_INFO
>        interface version 2.01
>                    flags 0
>           manufacturerID "nCipher Corp. Ltd               "
>       libraryDescription "nCipher PKCS#11 1.71.21         "
>   implementation version 1.71
>
> slots[0] CK_SLOT_INFO
>          slotDescription "Racine
> "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
>
>
> slots[0] Token not present
> slots[1] CK_SLOT_INFO
>          slotDescription "SRV
> "
>           manufacturerID "nCipher Corp. Ltd               "
>                    flags 6
>                    flags & CKF_REMOVABLE_DEVICE
>                    flags & CKF_HW_SLOT
>         hardware version 0.00
>         firmware version 0.00
>
>
> slots[1] Token not present
>
>
> I have created the file /opt/nfast/cknfastrc :
>
> CKNFAST_LOADSHARING=1
> CKNFAST_NO_ACCELERATOR_SLOTS=1
> CKNFAST_NO_UNWRAP=1
> CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
> # CKNFAST_DEBUG=10
> # CKNFAST_DEBUGFILE=/tmp/nfast.debug
>
> the trace log is:
>
> 2013-07-10 09:36:01,053 DEBUG [org.ejbca.util.keystore.KeyTools] name =
> libcknfast.so-slot1
> library = /opt/nfast/toolkits/pkcs11/libcknfast.so
> slotListIndex = 1
> attributes(*, *, *) = {
>   CKA_TOKEN = true
> }
> attributes(*, CKO_PUBLIC_KEY, *) = {
>   CKA_ENCRYPT = true
>   CKA_VERIFY = true
>   CKA_WRAP = true
> }
> attributes(*, CKO_PRIVATE_KEY, *) = {
>   CKA_PRIVATE = true
>   CKA_SENSITIVE = true
>   CKA_EXTRACTABLE = false
>   CKA_DECRYPT = true
>   CKA_SIGN = true
>   CKA_UNWRAP = true
> }
>
> 2013-07-10 09:36:01,054 DEBUG [org.ejbca.util.keystore.KeyTools]
> {SLOT_ID=[1], PKCS11_NATIVE_MODULE=/opt/nfast/toolkits/pkcs11/libcknfast.so}
> 2013-07-10 09:36:01,058 INFO  [org.ejbca.util.keystore.KeyTools] Using SUN
> PKCS11 provider: sun.security.pkcs11.SunPKCS11
> 2013-07-10 09:36:01,156 ERROR [org.ejbca.util.keystore.KeyTools] Error
> constructing pkcs11 provider: null
> 2013-07-10 09:36:01,158 ERROR [org.ejbca.ui.cli.HSMKeyTool] Command
> 'PKCS11HSMKeyTool generate /opt/nfast/toolkits/pkcs11/libcknfast.so null
> pkcs11 4096 defaultSRV i1' could not be executed.
> java.io.IOException: Error constructing pkcs11 provider: null
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:908)
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:864)
>         at
> org.ejbca.util.keystore.KeyStoreContainerP11.getInstance(KeyStoreContainerP11.java:51)
>         at
> org.ejbca.util.keystore.KeyStoreContainerFactory.getInstance(KeyStoreContainerFactory.java:55)
>         at org.ejbca.ui.cli.HSMKeyTool.doIt(HSMKeyTool.java:137)
>         at org.ejbca.ui.cli.HSMKeyTool.execute(HSMKeyTool.java:290)
>         at
> org.ejbca.ui.cli.PKCS11HSMKeyTool.execute(PKCS11HSMKeyTool.java:47)
>         at
> org.ejbca.ui.cli.ClientToolBox.executeIfSelected(ClientToolBox.java:40)
>         at org.ejbca.ui.cli.ClientToolBox.main(ClientToolBox.java:70)
> Caused by: java.lang.reflect.InvocationTargetException
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
>         at
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
>         at
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>         at java.lang.reflect.Constructor.newInstance(Constructor.java:532)
>         at
> org.ejbca.util.keystore.KeyTools.getP11Provider(KeyTools.java:905)
>         ... 8 more
> Caused by: java.security.ProviderException: Initialization failed
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:358)
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:107)
>         ... 13 more
> Caused by: java.security.ProviderException: slotListIndex is 1 but token
> only has 1 slots
>         at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
>         ... 14 more
>
>
> ckinfo give the index 1 for SRV.   How do yo explain this ?
>
> Kind regards
>
> Daniel JAMET
> Direction DPM
> Tél : +33 1 55 23 31 70
> dan...@e-...
> ____________________________
> Société d'Exploitation de Réseaux et de Services Sécurisés
> Immeuble "Le Linéa"
> 1, rue du Général Leclerc
> 92800 PUTEAUX
>
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> _______________________________________________
> Ejbca-develop mailing list
> Ejb...@li...
> https://lists.sourceforge.net/lists/listinfo/ejbca-develop
>