The go-p11-kit's discuss from google

go-p11-kit's Issues

Determine if intermediate certificates should support SetCertificate

SetCertificate only works for setting the CKA_ID for public and private keys. Figure out if this should also work for intermediate certificates.

Functions missing to support gnutls or managed p11-kit modules

#20 includes additional context here.

$ cat /usr/share/p11-kit/modules/gop11kit.module 
remote: |/home/gerow/repos/go-p11-kit/bin/example-p11-kit-server --priv /home/gerow/repos/go-p11-kit/example/priv.pem --pub /home/gerow/repos/go-p11-kit/example/pub.pem --cert /home/gerow/repos/go-p11-kit/example/cert.pem --stdio

$ p11tool --list-all
warning: no token URL was provided for this operation; the available tokens are:

pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example
2022/04/27 16:41:37 Handling over stdio: read request: reading request header: EOF

$ gnutls-cli google.com --app-proto=https --x509keyfile='pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example' --x509certfile='pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example'
Processed 141 CA certificate(s).
2022/04/27 16:42:49 Error with C_GetSessionInfo: CKR_FUNCTION_NOT_SUPPORTED
Token 'example' with URL 'pkcs11:model=example-server;manufacturer=go-p11-kit;serial=12345678;token=example' requires user PIN
Enter PIN: 
2022/04/27 16:42:52 Error with C_Login: CKR_FUNCTION_NOT_SUPPORTED
*** Error loading cert file.
2022/04/27 16:42:52 Handling over stdio: read request: reading request header: EOF

Seems we should just need to add support for C_GetSessionInfo if we want to be able to convince gnutls that we don't need a pin for the token.

Recommend Projects