Setting up softhsm

[pjakobi]

Still running on F42, dogtag 11.6, softhsm-2.6.1
Then I try to run "pkispawn -s CA -f ca.cfg", that file being exactly what is described at the following link : https://github.com/dogtagpki/pki/blob/master/docs/installation/ca/installing-ca-with-hsm.adoc.

spawn fails telling me
ERROR: Failed to add module "softhsm". Probable cause : "Unknown PKCS #11 error.".
ERROR: CalledProcessError: Command '['modutil', '-dbdir', '/var/lib/pki/pki-tomcat/conf/alias', '-nocertdb', '-add', 'softhsm', '-libfile', '/usr/lib64/pkcs11/libsofthsm2.so', '-force']' returned non-zero exit status 22.

Problem is that I have no idea about what means exit status 22... Can someone tell me, I will try to dig the issue further....

Thxs in adv.

[fmarco76]

Have you created the token before using it? As an example this is in github action: https://github.com/dogtagpki/pki/blob/master/.github/workflows/ca-hsm-test.yml#L55

[pjakobi]

Thanks. I did a retry, same result. softhsm2-util --init-token works as a charm.

The problem is with modutil, which does not work. On F42, if you dnf install softhsm, you can see this, even without dogtag.
Just install softhsm, then run manually (what does pkispawn)
modutil -dbdir /etc/pki/nssdb -nocertdb -force -add softhsm -libfile /usr/lib64/pkcs11/libsofthsm2.so
and you will get the same result.
The question is what has to be done before running modutil, which is what I am at at the moment.

[pjakobi]

Traces :

modutil -dbdir /etc/pki/nssdb -nocertdb -force -add softhsm -libfile /usr/lib64/pkcs11/libsofthsm2.so

WARNING: Manually adding a module while p11-kit is enabled could cause
duplicate module registration in your security database. It is suggested
to configure the module through p11-kit configuration file instead.

Type 'q ' to abort, or to continue:

ERROR: Failed to add module "softhsm". Probable cause : "Unknown PKCS #11 error.

[pjakobi]

Marco
I just browsed pkispawn.py. Are you sure, dogtag 11.6 supports HSMs (all HSM stuff seems to be commented out) ?
If not supported, which version should I use to have HSM support ?

[fmarco76]

11.6 supports HSM and it has been tested on F41 but development has continued in F42 without problem.
I have done a quick test and it is created without problem:

[root@pki alias]# certutil -d . -L -h HSM

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Enter Password or Pin for "HSM":
HSM:subsystem                                                u,u,u
HSM:ca_ocsp_signing                                          u,u,u
HSM:ca_audit_signing                                         u,u,Pu
HSM:ca_signing                                               CTu,Cu,Cu
[root@pki alias]# certutil -d . -L 

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

ca_signing                                                   CT,C,C
ca_ocsp_signing                                              ,,   
sslserver                                                    u,u,u
subsystem                                                    ,,   
ca_audit_signing                                             ,,P  
[root@pki alias]# ls -laR /var/lib/softhsm/tokens
/var/lib/softhsm/tokens:
total 0
drwxrwx--T. 1 ods     ods       72 Jul 31 08:16 .
drwxr-x---. 1 ods     ods       12 Jul 31 08:15 ..
drwx------. 1 pkiuser pkiuser 2080 Jul 31 08:20 82c3972f-5e36-b783-3ae8-f1189cf37e6a

/var/lib/softhsm/tokens/82c3972f-5e36-b783-3ae8-f1189cf37e6a:
total 56
drwx------. 1 pkiuser pkiuser 2080 Jul 31 08:20 .
drwxrwx--T. 1 ods     ods       72 Jul 31 08:16 ..
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 08f826ee-f805-0d51-2813-81d631823b89.lock
-rw-------. 1 pkiuser pkiuser  955 Jul 31 08:20 08f826ee-f805-0d51-2813-81d631823b89.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 1b291699-d0b8-9881-7548-ffb14b302215.lock
-rw-------. 1 pkiuser pkiuser  827 Jul 31 08:20 1b291699-d0b8-9881-7548-ffb14b302215.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 327e43da-b640-0f16-9626-090a06789a48.lock
-rw-------. 1 pkiuser pkiuser 2785 Jul 31 08:20 327e43da-b640-0f16-9626-090a06789a48.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 4f047949-5af2-2862-9925-e2f3a6cabc09.lock
-rw-------. 1 pkiuser pkiuser 2785 Jul 31 08:20 4f047949-5af2-2862-9925-e2f3a6cabc09.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 697158c1-22bd-1310-8c08-ee1675e1ce67.lock
-rw-------. 1 pkiuser pkiuser 1805 Jul 31 08:20 697158c1-22bd-1310-8c08-ee1675e1ce67.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 6fbb61bf-4345-3f25-7aac-163b4dd28009.lock
-rw-------. 1 pkiuser pkiuser 1952 Jul 31 08:20 6fbb61bf-4345-3f25-7aac-163b4dd28009.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 8c5ea241-2a45-4c22-f767-b930caa10675.lock
-rw-------. 1 pkiuser pkiuser 2209 Jul 31 08:20 8c5ea241-2a45-4c22-f767-b930caa10675.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 c5c2de00-3a6c-fe20-383e-0d072f8eaf6d.lock
-rw-------. 1 pkiuser pkiuser 2209 Jul 31 08:20 c5c2de00-3a6c-fe20-383e-0d072f8eaf6d.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 d4e29ca9-91ce-aa7d-5828-04d1355d7228.lock
-rw-------. 1 pkiuser pkiuser 1803 Jul 31 08:20 d4e29ca9-91ce-aa7d-5828-04d1355d7228.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 d82248ba-1c90-5a23-75c0-3062b3b2fa5c.lock
-rw-------. 1 pkiuser pkiuser  827 Jul 31 08:20 d82248ba-1c90-5a23-75c0-3062b3b2fa5c.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 db6bd4dc-3ad1-1e36-5dda-cf2e819a59d9.lock
-rw-------. 1 pkiuser pkiuser 1896 Jul 31 08:20 db6bd4dc-3ad1-1e36-5dda-cf2e819a59d9.object
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:20 f5b85eea-1d6c-a921-1ae2-196d128fbc5e.lock
-rw-------. 1 pkiuser pkiuser  955 Jul 31 08:20 f5b85eea-1d6c-a921-1ae2-196d128fbc5e.object
-rw-------. 1 pkiuser pkiuser    8 Jul 31 08:23 generation
-rw-------. 1 pkiuser pkiuser    0 Jul 31 08:22 token.lock
-rw-------. 1 pkiuser pkiuser  320 Jul 31 08:22 token.object
[root@pki alias]# cat /etc/redhat-release 
Fedora release 42 (Adams)
[root@pki /]# rpm -qa|grep pki
python3-dogtag-pki-11.6.2-1.fc42.noarch
dogtag-pki-base-11.6.2-1.fc42.noarch
dogtag-pki-java-11.6.2-1.fc42.noarch
dogtag-pki-tools-11.6.2-1.fc42.x86_64
dogtag-pki-server-11.6.2-1.fc42.noarch
dogtag-pki-acme-11.6.2-1.fc42.noarch
dogtag-pki-ca-11.6.2-1.fc42.noarch
dogtag-pki-est-11.6.2-1.fc42.noarch
dogtag-pki-kra-11.6.2-1.fc42.noarch
dogtag-pki-ocsp-11.6.2-1.fc42.noarch
dogtag-pki-tks-11.6.2-1.fc42.noarch
dogtag-pki-tps-11.6.2-1.fc42.noarch
dogtag-pki-theme-11.6.2-1.fc42.noarch
dogtag-pki-tests-11.6.2-1.fc42.noarch
dogtag-pki-javadoc-11.6.2-1.fc42.noarch
dogtag-pki-11.6.2-1.fc42.x86_64
pki-debugsource-11.6.2-1.fc42.x86_64
dogtag-pki-tools-debuginfo-11.6.2-1.fc42.x86_64
[root@pki /]# rpm -qa|grep softh
softhsm-2.6.1-11.fc42.x86_64

Certificate are correctly stored in HSM.

I have tested the modutil command and I get the same error but I have not verified how it is used in pki. For the test I have followed the same steps of https://github.com/dogtagpki/pki/blob/v11.6/.github/workflows/ca-hsm-test.yml

[pjakobi]

Thanks a lot for this, it helps a lot. I will work this today and keep you informed.
Your stuff is reassuring as it proves that we can use softhsm with Dogtag 11.6.
However, it is a fact that using pkispawn, I got to the point where modutil was called (it probably shouldn't)...

[pjakobi]

OK. Got it. Now the CA has been installed, thanks to your indications. And obviously the "modutil" error has disappeared...

Reason for the issue is that the documentation I followed is flawed (https://github.com/dogtagpki/pki/blob/master/docs/installation/ca/installing-ca-with-hsm.adoc).

1. It does not mention that a token has to be created for pkiuser with softhsm2-util. At first, I believed this is done within pkispawn.
2. As I already mentioned, the ca.cfg that is provided is wrong. I detected that using your yaml file. The token name/password is not declared, as well as the pki-_signing_token= clauses.

Do you want me to propose a corrected version of the installation page ?

Next : KRA install.

Best,
P

[fmarco76]

@pjakobi Good you get it working.

If you would to contribute to improve the documentation feel free to open a PR with your changes.

Thanks.