Uploaded image for project: 'Support'
  1. Support
  2. SUPPORT-151

A marked as trusted certificate cannot be written in a softhsmv2 db

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: SoftHSM 2.0.0a2
    • Fix Version/s: None
    • Component/s: PKCS#11 Interface
    • Labels:
      None

      Description

      I used softhsm-2.0.0b1 from fedora 21 and trying to write a certificate in a softhsm db with CKA_TRUSTED fails with:
      P11Attributes.cpp(407): A trusted certificate cannot be modified

      How reproducible:
      1. cat >config
      directories.tokendir = db
      objectstore.backend = file

      2. export SOFTHSM2_CONF=config
      3. mkdir db
      4. softhsm2-util --init-token --slot 0 --label test --so-pin 1234 --pin 1234
      5. p11tool --provider /usr/lib64/pkcs11/libsofthsm2.so --write --mark-trusted --load-certificate any-cert.pem --label test --so-login

      Output:
      Error writing certificate: PKCS #11 error in attribute

      Expected Output:
      Success.

      Writing the same certificate without the mark-trusted flag works fine.

      This seems to be a regression from version 1, as this use case works properly with softhsmv1. The p11tool is from gnutls utils.

      I attach the output from pkcs11-spy for the failed operation.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              rickard Rickard Bellgrim
              Reporter:
              nmav Nikos Mavrogiannopoulos
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: