I am running OpenSUSE LEAP15.1 and a seeing the following when trying to use a Nitrokey USB HSM:
engine "pkcs11" set. Unable to load module (null) Unable to load module (null) PKCS11_get_private_key returned NULL cannot load CA private key from engine 140396815820608:error:81065401:libp11:pkcs11_CTX_load:Unable to load PKCS#11 module:p11_load.c:77: 140396815820608:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:crypto/engine/eng_pkey.c:78: unable to load CA private key unable to load certificates
However, PKCS is functional:
pkcs11-tool --test Using slot 0 with a present token (0x0) C_SeedRandom() and C_GenerateRandom(): seeding (C_SeedRandom) not supported seems to be OK Digests: all 4 digest functions seem to work MD5: OK SHA-1: OK RIPEMD160: OK Signature: not a R/W session, skipping signature tests Verify: not a R/W session, skipping verify tests Key unwrap: not a R/W session, skipping key unwrap tests Decryption: not a R/W session, skipping decryption tests No errors pkcs15-tool -D Using reader with a card: Nitrokey Nitrokey HSM (DENK99999999 ) 00 00 PKCS#15 Card [SmartCard-HSM]: Version : 0 Serial number : DENK999999 Manufacturer ID: www.CardContact.de Flags : PIN [UserPIN] etc. etc. etc.
openssl-engine-libp11 packages are installed and my openssl.conf file has the correct settings:
[openssl_def] engines = engine_section [engine_section] pkcs11 = pkcs11_section [pkcs11_section] #engine_id = pkcs11 #Note: I have tried both with and without this setting dynamic_path= /usr/lib64/engines-1.1/pkcs11.so MODULE_PATH = /usr/lib64/opensc-pkcs11.so #init = 0 #Note: I have tried both with and without this setting
And I have verified the files exist:
> ls /usr/lib64/engines-1.1/pkcs11.so /usr/lib64/engines-1.1/pkcs11.so > ls /usr/lib64/opensc-pkcs11.so /usr/lib64/opensc-pkcs11.so