Re: pkcs15-init --store-certificate: Failed to store certificate: Non unique object ID

On Wed, 2020-01-29 at 10:05 +0200, Graham Leggett wrote:
> Hi all,
> 
> When an attempt is made to load a renewed certificate onto a properly
> formatted and otherwise working smartcard as follows, the error "Non
> unique object ID" is returned as follows:
> 
> [root@gatekeeper ~]# pkcs15-init --store-certificate john.cer --label 
> "John Smith (Globalsign)" --auth-id 01
> Using reader with a card: ACS ACR 38U-CCID 00 00
> Failed to store certificate: Non unique object ID
> 
> Can someone explain what this error is trying to tell me?

You are trying to write an object with the same ID that already exists.

> What is an “object ID” when it comes to a certificate?

Object ID is a ID used to pair public, private and certificate objects
in PKCS#11 layer and I believe also in PKCS#15 layer.

> There is a previous certificate on the same smartcard that is being
> renewed, does this previous certificate need to be removed before the
> replacement is added?

Probably yes. Certainly it should not have the same ID as the new one.
In that case, the applications would not know which of the certificates
to use easily before parsing the whole blob.

Regards,
-- 
Jakub Jelen
Senior Software Engineer
Security Technologies
Red Hat, Inc.



_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel