Re: exceptions occur when I use LOAD_CERT_CTRL

./src/eng_back.c ctx_load_cert() is expecting s_slot_cert_id is either a URI based on RFC7512 or the old way as defined in
./src/eng_parse.c parse_slot_id_string. This looks like it is assuming the slot is not defined and returns slot=-1 and the hex id.


slot=-1 may not be the issue, but is easy to change.

You are calling a routine that is normally called internally by libp11,
so it may be missing some setup that libp11 would have done.

Something else that might help in debugging is to use the OpenSC pkcs11 SPY module as the module loaded.

https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC#pkcs-11-spy

On 1/5/2021 11:35 PM, George wrote:
> Hi,
> 
> I'm trying to use a certificate on a smart card with OpenSSL + libp11 in Windows 10. However, when I attempt to configure the OpenSSL PKCS11 engine with "*LOAD_CERT_CTRL*", I'm seeing some exceptions. 
> Here is my console output :
> 
>     'GENCom.exe' (Win32): Loaded 'C:\Users\whipp\junk4\libp11-libp11-0.4.11\src\pkcs11.dll'. Module was built without symbols.
>     *Exception thrown at 0x75D046D2 in GENCom.exe: Microsoft C++ exception: unsigned long at memory location 0x0355CE98.*
>     *'GENCom.exe' (Win32): Loaded 'C:\Program Files (x86)\HID Global\ActivClient\ac.smmw.mwctl.dll'. *
>     *'GENCom.exe' (Win32): Loaded 'C:\Program Files (x86)\HID Global\ActivClient\ac.smmw.common.srvprov.dll'. *
>     *'GENCom.exe' (Win32): Loaded 'C:\Program Files (x86)\HID Global\ActivClient\ac.smmw.common.srvctl.dll'. *
>     .
>     .
>     .
> 
> 
> Here is a snippet of what my code looks like:
> 
>     struct
>     {
>         const char* s_slot_cert_id;
>         X509* cert;
>     } cert_info;
>     *cert_info.s_slot_cert_id = "a9bee4d72100c52f77c3fc288d2be01a34b5d44f91b3b7ea3d349b8a25752c45";*
>     cert_info.cert = NULL;
> 
>     *int return Code = ENGINE_ctrl_cmd(engine, "LOAD_CERT_CTRL", 0, &cert_info, NULL, 0);*
>     *returnCode = SSL_CTX_use_certificate(sslContext, cert_info.cert);*
> 
> *
> 
> *The return code from ENGINE_ctrl_cmd is "1" even though I am seeing some exceptions. Does anyone know what is causing the exceptions and how I can fix it?
> Are there any debug logs I can look at? It seems like cert_info.cert is being populated with a value, but I am not sure if it is valid or not.*
> *
> The value "2b2586c684d69b670c0a805edf514e720f2b757d8e2faa0b3a7ff23d1ccfc7ba" is the object ID of the certificate on the smart card:
> 
>     C:\Program Files\OpenSC Project\OpenSC\tools>pkcs11-tool --module="C:\Program Files\HID Global\ActivClient/acpkcs211.dll" -l -O
>     Using slot 0 with a present token (0x0)
>     Certificate Object; type = X.509 cert
>        label:      Authentication - *
>        subject:    DN: C=CA, ST=ON, L=OT, O=ABCD, OU=EFG, CN=*
>     *ID: 2b2586c684d69b670c0a805edf514e720f2b757d8e2faa0b3a7ff23d1ccfc7ba*
>     .
>     .
>     .
> 
> 
> I tried to manually use LOAD_CERT_CTRL in the openssl shell but I cannot seem to get it to work and cannot find any examples of how to use it.  Is the syntax for *LOAD_CERT_CTRL* correct? Is there any 
> detailed documentation on how to use it?
> 
> Here is what I am trying to do
> 
>     OpenSSL> engine -vvvv -t dynamic -pre "SO_PATH:C:\\Users\\whipp\\junk4\\libp11-libp11-0.4.11\\src\\pkcs11.dll" -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre "MODULE_PATH:C:\Program Files (x86)\HID
>     Global\ActivClient\\acpkcs211.dll" -pre PIN:123456 -pre FORCE_LOGIN *-pre "LOAD_CERT_CTRL:a9bee4d72100c52f77c3fc288d2be01a34b5d44f91b3b7ea3d349b8a25752c45"
> 
>     *(dynamic) Dynamic engine loading support
>     [Success]: SO_PATH:C:\\Users\\whipp\\junk4\\libp11-libp11-0.4.11\\src\\pkcs11.dll
>     [Success]: ID:pkcs11
>     [Success]: LIST_ADD:1
>     [Success]: LOAD
>     [Success]: MODULE_PATH:C:\Program Files (x86)\HID Global\ActivClient\\acpkcs211.dll
>     [Success]: PIN:123456
>     [Success]: FORCE_LOGIN
>     *[Failure]: LOAD_CERT_CTRL:a9bee4d72100c52f77c3fc288d2be01a34b5d44f91b3b7ea3d349b8a25752c45**
>     **4196:error:260AB086:engine routines:ENGINE_ctrl_cmd_string:cmd not executable:.\crypto\engine\eng_ctrl.c:316:*
>     Loaded: (pkcs11) pkcs11 engine
>           [ available ]
>           SO_PATH: Specifies the path to the 'pkcs11' engine shared library
>                (input flags): STRING
>           MODULE_PATH: Specifies the path to the PKCS#11 module shared library
>                (input flags): STRING
>           PIN: Specifies the pin code
>                (input flags): STRING
>           VERBOSE: Print additional details
>                (input flags): NO_INPUT
>           QUIET: Remove additional details
>                (input flags): NO_INPUT
>     *LOAD_CERT_CTRL: Get the certificate from card**
>     **          (input flags): [Internal]*
>           INIT_ARGS: Specifies additional initialization arguments to the PKCS#11 module
>                (input flags): STRING
>           SET_USER_INTERFACE: Set the global user interface (internal)
>                (input flags): [Internal]
>           SET_CALLBACK_DATA: Set the global user interface extra data (internal)
>                (input flags): [Internal]
>           FORCE_LOGIN: Force login to the PKCS#11 module
>                (input flags): NO_INPUT
>     OpenSSL>
> 
> 
> 
> 
> 
> Thanks,
> George
> *
> *
> 
> 
> _______________________________________________
> Opensc-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/opensc-devel
> 

-- 

  Douglas E. Engert  <[email protected]>



_______________________________________________
Opensc-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/opensc-devel