CAdES signature not working with pkcs11 engine

Raimondo Giammanco <[email protected]>
Newsgroups gmane.comp.encryption.openssl.user
Message-ID <[email protected]>
My operating system is EndeavourOS, so I use Arch Linux repos.
I would like to use openssl to create CMS Advanced Electronic Signatures 
(CAdES)
I have the certificates on an Italian smart card that is recognized by the 
system after installing:  
*pcsclite ccid opensc*
And in fact using the proprietary sw provided by the smartcard supplier I 
can successfully affix the CAdES signature.
To use openssl I installed:  
*libp11*
and added the following lines to /usr/lib/ssl/openssl.cnf
openssl_conf = openssl_init

[openssl_init]
engines = engine_section

[engine_section]
pkcs11 = pkcs11_section

[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/engines-3/pkcs11.so
MODULE_PATH = /usr/lib/onepin-opensc-pkcs11.so

Then I tried to sign with the same command that worked on ubuntu

openssl cms -nosmimecap -md sha256 -nodetach -binary -cades \
-stream -outform DER -sign -signer $cert_pem -inkey $ID \
-keyform engine -in "$infile" -out "$outfile" -engine pkcs11

where $ID is the ID of the key read from the smartcard using pkcs11-tool
while $cert_pem is obtained by converting the binary certificate extracted 
with pkcs11-tool.
Unfortunately I get the following output:

Engine "pkcs11" set.
Failed to enumerate slots
PKCS11_get_private_key returned NULL
Could not find private key of signing key from org.openssl.engine:pkcs11:01
806BDA451E730000:error:40000067:pkcs11 engine:ERR_ENG_error:invalid 
parameter:eng_back.c:699:
806BDA451E730000:error:13000080:engine 
routines:ENGINE_load_private_key:failed loading private 
key:crypto/engine/eng_pkey.c:79:

Thanks for any contribution towards the solution

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/3be365cb-4c94-4a58-ad45-677f6cc15a06n%40openssl.org.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.