I completely understand what you say now. I wil contact with TUBITAK on that why i . mithat at adige:/etc/pkcs11/modules$ p11tool --list-all --login pkcs11:serial=0036218D34081A32 p11-kit: the 'log-calls' option for module 'akis' is only supported for managed modules Token 'Akis' with URL 'pkcs11:model=AKIS%20V1.2%00%00%00%00%00%00%00;manufacturer=TUBITAK-UEKAE%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00;serial=0036218D34081A32;token=Akis%00A%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff' requires user PIN Object 0: URL: pkcs11:model=AKIS%20V1.2%00%00%00%00%00%00%00;manufacturer=TUBITAK-UEKAE%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00;serial=0036218D34081A32;token=Akis%00A%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff;id=%fd%90%0c%3b%c4%20%b0%b4%39%f7%1e%fa%02%ef%df%45%50%91%8f%c4;object=62917107586SIGN0;type=cert Type: X.509 Certificate Label: 62917107586SIGN0 ID: fd:90:0c:3b:c4:20:b0:b4:39:f7:1e:fa:02:ef:df:45:50:91:8f:c4 Object 1: URL: pkcs11:model=AKIS%20V1.2%00%00%00%00%00%00%00;manufacturer=TUBITAK-UEKAE%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00;serial=0036218D34081A32;token=Akis%00A%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff;id=%00%90%20%15%9e%08%d3%ab%e2%4b%d1%a0%74%23%28%c2%8b%0c%11%04;object=62917107586NES0;type=cert Type: X.509 Certificate Label: 62917107586NES0 ID: 00:90:20:15:9e:08:d3:ab:e2:4b:d1:a0:74:23:28:c2:8b:0c:11:04 Object 2: URL: pkcs11:model=AKIS%20V1.2%00%00%00%00%00%00%00;manufacturer=TUBITAK-UEKAE%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00;serial=0036218D34081A32;token=Akis%00A%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff;id=%00%90%20%15%9e%08%d3%ab%e2%4b%d1%a0%74%23%28%c2%8b%0c%11%04;object=62917107586NES0;type=private Type: Private key Label: 62917107586NES0 Flags: CKA_PRIVATE; CKA_SENSITIVE; ID: 00:90:20:15:9e:08:d3:ab:e2:4b:d1:a0:74:23:28:c2:8b:0c:11:04 Object 3: URL: pkcs11:model=AKIS%20V1.2%00%00%00%00%00%00%00;manufacturer=TUBITAK-UEKAE%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00;serial=0036218D34081A32;token=Akis%00A%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff;id=%fd%90%0c%3b%c4%20%b0%b4%39%f7%1e%fa%02%ef%df%45%50%91%8f%c4;object=62917107586SIGN0;type=private Type: Private key Label: 62917107586SIGN0 Flags: CKA_PRIVATE; CKA_SENSITIVE; ID: fd:90:0c:3b:c4:20:b0:b4:39:f7:1e:fa:02:ef:df:45:50:91:8f:c4 mithat at adige:/etc/pkcs11/modules$ openconnect -c 'pkcs11:serial=0036218D34081A32;object=62917107586SIGN0;type=private' xxx.xx.x.xx POST https://xx.x.x.x./ Attempting to connect to server xx.x.x.x:443 p11-kit: the 'log-calls' option for module 'akis' is only supported for managed modules PIN required for Akis Enter PIN: Error loading certificate from PKCS#11: ASN1 parser: Error in TAG. Loading certificate failed. Aborting. Failed to open HTTPS connection to xx.x.x.x Failed to obtain WebVPN cookie 2016-02-24 14:24 GMT+02:00 David Woodhouse <dwmw2 at infradead.org>: > Adding p11-glue list to Cc. There are a couple of issues here, albeit > bugs in a crappy proprietary PKCS#11 token, that we might want to work > around in libp11-kit. > > On Wed, 2016-02-24 at 14:06 +0200, Mithat Bozkurt wrote: >> Tubitak haven't return back yet. but i think no need this. because >> after install opensc from ubuntu software center and run following >> command i can see >> >> >> mithat at adige:~$ pkcs11-tool --module /usr/lib/libakisp11.so -O -l >> Using slot 0 with a present token (0x1) >> Logging in to "Akis". >> Please enter User PIN: >> Public Key Object; RSA 2048 bits >> label: 62917107586NES0 >> ID: 009020159e08d3abe24bd1a0742328c28b0c1104 >> Usage: verify >> Public Key Object; RSA 2048 bits >> label: 62917107586SIGN0 >> ID: fd900c3bc420b0b439f71efa02efdf4550918fc4 >> Usage: verify >> Certificate Object, type = X.509 cert >> label: 62917107586SIGN0 >> ID: fd900c3bc420b0b439f71efa02efdf4550918fc4 >> Certificate Object, type = X.509 cert >> label: 62917107586NES0 >> ID: 009020159e08d3abe24bd1a0742328c28b0c1104 >> Private Key Object; RSA >> label: 62917107586NES0 >> ID: 009020159e08d3abe24bd1a0742328c28b0c1104 >> Usage: sign >> warning: PKCS11 function C_GetAttributeValue(ALWAYS_AUTHENTICATE) >> failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12) >> >> Private Key Object; RSA >> label: 62917107586SIGN0 >> ID: fd900c3bc420b0b439f71efa02efdf4550918fc4 >> Usage: sign >> warning: PKCS11 function C_GetAttributeValue(ALWAYS_AUTHENTICATE) >> failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12) > > OK, so you're not actually using the OpenSC PKCS#11 module here; you're > only using the pkcs11-tool from OpenSC, to operate on the Tubitak > module. Which works OK in this environment. > >> With this config it seems ok >> mithat at adige:/etc/pkcs11/modules$ more akis.module >> module: /usr/lib/libakisp11.so >> #module: /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so >> managed: no > > ... and when p11-kit uses that *same* Tubitak module in non-managed > mode, the module *does* work. > > (Repeating for the benefit of the p11-kit list: It's only in managed > mode, where we pass a NULL argument to C_Initialize(), that the Tubitak > module fails as follows: > >>> C_Initialize >>> IN: pInitArgs = NULL >>> C_Initialize = CKR_ARGUMENTS_BAD >>> p11-kit: akis: module failed to initialize, skipping: Invalid arguments > > ) > >> mithat at adige:/etc/pkcs11/modules$ p11tool --list-tokens >> p11-kit: the 'log-calls' option for module 'akis' is only supported >> for managed modules >> ....//trimmed >> Token 1: >> URL: >> pkcs11:model=AKIS%20V1.2%00%00%00%00%00%00%00;manufacturer=TUBITAK- >> UEKAE%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00;serial >> =0036218D34081A32;token=Akis%00A%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff% >> ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff%ff >> Label: Akis >> Type: Hardware token, Trust module >> Manufacturer: TUBITAK-UEKAE >> Model: AKIS V1.2 >> Serial: 0036218D34081A32 >> .....//trimmed >> >> But this time i cant read cert > > Define "can't read cert". Do you just mean that you didn't see any > certs listed in the output of p11-tool as shown above? That's expected; > you only asked it to list the *tokens*. > > Try: > p11tool --list-all --login pkcs11:serial=0036218D34081A32 > > (I spy other bugs in your proprietary PKCS#11 module there too; the > model, manufacturer and token fields are all stuffed with nonsense when > they *should* be padded with space characters.) > > -- > dwmw2 >
