java keytool with opensc pkcs#11 provider only works with debug option enabled

by

I got the same problem today and I digged onto the java sources until I found the source of the problem. I know this question is quite old and already have an accepted answer, but that one is not a real answer.

Basically, the SunPKCS11 provider does list all available slots, then, get the slot you specified in your config, and give the error (since you do not specified any slot and fot its default value).

When in debug, after listing all available slots, it does list all slots with a smartcard inserted. After having print all these information about the slot list, it does initialise its slotid variable overwriting what you wrote (or forget to write) in your config. The new value is a correct one since it is read from the opensc defaults.

This is the relevant code from SunPKCS11.java from openjdk project:

    long slotID = config.getSlotID();
    // ....
        if ((slotID < 0) || showInfo) {
            long[] slots = p11.C_GetSlotList(false);
            if (showInfo) {
                System.out.println("All slots: " + toString(slots));
                slots = p11.C_GetSlotList(true);
                System.out.println("Slots with tokens: " + toString(slots));
            }
            if (slotID < 0) {
                if ((slotListIndex < 0) || (slotListIndex >= slots.length)) {
                    throw new ProviderException("slotListIndex is " + slotListIndex
                        + " but token only has " + slots.length + " slots");
                }
                slotID = slots[slotListIndex];
            }
        }
        this.slotID = slotID;

So, a workaround is to always include in your config a negative value like slot = -1, so that the provider will always look for the right one.

More Related Contents:

  1. Accept server’s self-signed ssl certificate in Java client
  2. Unable to find valid certification path to requested target – error even after cert imported
  3. How to properly import a selfsigned certificate into Java keystore that is available to all Java applications by default?
  4. Trust Store vs Key Store – creating with keytool
  5. Importing the private-key/public-certificate pair in the Java KeyStore [duplicate]
  6. How do I find out what keystore my JVM is using?
  7. Java keytool easy way to add server cert from url/port
  8. Programmatically Import CA trust cert into existing keystore file without using keytool
  9. How to convert .pfx file to keystore with private key?
  10. Openssl is not recognized as an internal or external command
  11. Key hash for Facebook Android SDK
  12. Common Access Card (CAC) Authentication Using Java
  13. Generate certificates, public and private keys with Java [closed]
  14. Keytool Signing Problem: Keystore was tampered with, or password was incorrect
  15. Where is the Keytool application?
  16. Java Keytool error after importing certificate , “keytool error: java.io.FileNotFoundException & Access Denied”
  17. How to determine an object’s class?
  18. What’s the difference between map() and flatMap() methods in Java 8?
  19. Java “lambda expressions not supported at this language level”
  20. What is the difference between ‘E’, ‘T’, and ‘?’ for Java generics?
  21. Equivalent function to C’s “_getch()” in Java?
  22. What is the difference between a HashMap and a TreeMap? [duplicate]
  23. Algorithm for finding all paths in a NxN grid
  24. Converting `BufferedImage` to `Mat` in OpenCV
  25. functional interface that takes nothing and returns nothing [duplicate]
  26. Manifest merger failed : Attribute application@appComponentFactory updating Firebase libraries
  27. Running SWT based, cross-platform jar properly on a Mac
  28. Java security: Sandboxing plugins loaded via URLClassLoader
  29. Automatically opening completion window in Eclipse
  30. What are the differences between information hiding and encapsulation?

Leave a Comment