[P11 - ERR 21:10:53.246143] util_pkcs11.c:4593 (parse_rsa_generate_template): Boolean truth check failed for attribute 0x1 [P11 - ERR 21:10:53.246154] yubihsm_pkcs11.c:5248 (C_GenerateKeyPair): Unable to parse generation template about yubihsm-shell HOT 5 OPEN

If possible, run this with debugging active, which can be done by adding setting to the config file or by setting an environment variable, see here https://docs.yubico.com/hardware/yubihsm-2/hsm-2-user-guide/hsm2-pkcs11-guide.html#configuration

from yubihsm-shell.

It looks like the application (meaning the client of yubihsm_pkcs11, which in this case also includes the Java pkcs11 wrapper) is setting CKA_TOKEN to CK_FALSE which isn't supported - all objects on the YubiHSM are created on the token. yubihsm_pkcs11 disallows that to avoid misleading users that objects can be created as session objects.

from yubihsm-shell.

what do you recommend in this case? I am implementing Yubihsm2 to ejbca.

from yubihsm-shell.

This is something that would need some configuration in ejbca, I know we have tested with it. Let me see If I can find some info.

from yubihsm-shell.

@Jmacea I just tried to generate an RSA2048 keypair in the Crypto Token view on EJBCA and did not run into problems. The key showed up when I listed the content of the YubiHSM using a separate tool and I could use the key to sign a certificate on EJBCA.

Since you have proper log from the yubihsm_pkcs11 module, I assume the configuration in conf/web.properties is correct so I'm suspecting it's a configuration issue elsewhere.

What is the version of the yubihsm_pkcs11 you are running? How are you generating the key? What does your Crypto Token configuration look like?

from yubihsm-shell.