pkcs11-provider with softhsm2

[gilweis]

Hi,
I tried to test this provider with softhsm2 (pkcs11).

The openssl.cnf:
openssl_conf = openssl_init

config_diagnostics = 1

[openssl_init]
providers = provider_sect

[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect
base = base_sect

[base_sect]
activate = 1

[default_sect]
activate = 1

[pkcs11_sect]
module = /home/gw/pkcs11-provider/src/.libs/pkcs11_provider.so
pkcs11-module-path = /usr/lib/softhsm/libsofthsm2.so
pkcs11-module-init-args = SOFTHSM2_CONF=/home/gw/.config/softhsm2/softhsm2.conf
pkcs11-module-token-pin = file:/home//gw/mytest/pinfile.txt
activate = 1

The results (OpenSSL 3.0.2):
$export OPENSSL_CONF=./openssl.cnf
$openssl pkey -in "pkcs11:type=public" -pubin -pubout -out testkey.pub
Could not open file or uri for loading public key of Public Key from pkcs11:type=public
40675381DD7F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file
40675381DD7F0000:error:80000002:system library:file_open:No such file or directory:../providers/implementations/storemgmt/file_store.c:267:calling stat(pkcs11:type=public)
40675381DD7F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=pkcs11
40675381DD7F0000:error:1608010C:STORE routines:inner_loader_fetch:unsupported:../crypto/store/store_meth.c:359:No store loader found. For standard store loaders you need at least one of the default or base providers available. Did you forget to load them? Info: Global default library context, Scheme (pkcs11 : 0), Properties ()

[simo5]

I used NSS softoken, because softhsm2 is currently hopeless, as it uses itself openssl but w/o using a private libctx, therefore if it loads it can only loop into itself forever.

However this specific error is happening because apparently the pkcs11-provider is failing to load, unfortunately openssl does not give errors in that case :-(

I suggest using strace to figure out if the .so is found and LD_DEBUG=all to find out if it is a linker issue.

[gilweis]

The strace log file:
strace.txt

[gilweis]

I tried to run:
$ openssl list -providers
pkcs11 isn't there.

$ strace openssl list -providers:
...
openat(AT_FDCWD, "/home/g/pkcs11-provider/src/.libs/pkcs11_provider.so", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
...