Using softhsm2 with openssl s_client

[fipscode]

How can I use softhsm2 with openssl's s_client? The softhsm2 initialization seems to work:

root@host:~# softhsm2-util --free --init-token --label test --so-pin 12345678 --pin 12345678
Slot 0 has a free/uninitialized token.
The token has been initialized and is reassigned to slot 2087010768
root@host:~# softhsm2-util --token test --import user.key.p8 --label test --id 0000 --pin 12345678
Found slot 2087010768 with matching token label.
The key pair has been imported.
root@host:~# softhsm2-util --token test --import user.crt --import-type cert --label test --id 0000 --pin 12345678
Found slot 2087010768 with matching token label.
The certificate has been imported.
root@host:~# softhsm2-util --show-slots
Available slots:
Slot 2087010768
    Slot info:
        Description:      SoftHSM slot ID 0x7c6541d0                                      
        Manufacturer ID:  SoftHSM project                 
        Hardware version: 2.7
        Firmware version: 2.7
        Token present:    yes
    Token info:
        Manufacturer ID:  SoftHSM project                 
        Model:            SoftHSM v2      
        Hardware version: 2.7
        Firmware version: 2.7
        Serial number:    ae7a54ee7c6541d0
        Initialized:      yes
        User PIN init.:   yes
        Label:            test                            
Slot 1
    Slot info:
        Description:      SoftHSM slot ID 0x1                                             
        Manufacturer ID:  SoftHSM project                 
        Hardware version: 2.7
        Firmware version: 2.7
        Token present:    yes
    Token info:
        Manufacturer ID:  SoftHSM project                 
        Model:            SoftHSM v2      
        Hardware version: 2.7
        Firmware version: 2.7
        Serial number:                    
        Initialized:      no
        User PIN init.:   no
        Label:                                            

This is my OpenSSL setup:

root@host:~# cat /etc/openssl.cnf
[openssl_init]
providers = providers

[providers]
default = provider_default
pkcs11 = provider_pkcs11

[provider_default]
activate = 0

[provider_pkcs11]
module = /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so
pkcs11-module-path = /usr/local/lib/softhsm/libsofthsm2.so
activate = 1
root@host:~# ls -ls /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so /usr/local/lib/softhsm/libsofthsm2.so
 193 -rw-r--r-- 1 root root   323816 Apr  1  2024 /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so
5741 -rwxr-xr-x 1 root root 10921424 Feb 25 21:22 /usr/local/lib/softhsm/libsofthsm2.so

But s_client seems not to (fully) use the PKCS#11 data:

root@host:~# export OPENSSL_CONF=/etc/openssl.cnf 
root@host:~# openssl s_client -provider pkcs11 -keyform engine
40A73E8CD07B0000:error:0A0000A1:SSL routines:SSL_CTX_new_ex:library has no ciphers:../ssl/ssl_lib.c:3326:
root@host:~# openssl s_client -provider pkcs11 -keyform engine -key 'pkcs11:'
No engine specified for loading client certificate private key
No filename or uri specified for loading
 client certificate private key

Can you provide me with the necessary s_client cmdline and some possible initialization I've missed?

Greetings,
Fabiano

[dengert]

Google for: latchset/provider examples s_client
The AI will find examples like:

openssl s_client -connect server.example.com:443
-provider pkcs11 -provider default
-cert "pkcs11:token=MyToken;object=MyClientCert;type=cert"
-key "pkcs11:token=MyToken;object=MyClientKey;type=private"

openssl s_client -connect server.example.com:443
-provider pkcs11 -provider default
-key "pkcs11:token=MyToken;pin-value=1234;object=MyClientKey;type=private"

drop the -engine as it is replaced by openssl provider.

[fipscode]

I've already tried without -engine since I'm aware of it being a deprecated API. But many examples still use them.
Different error, but still doesn't work:

root@host:~# openssl s_client -provider pkcs11 -provider default -cert "pkcs11:token=test;object=0000;type=cert" -key "pkcs11:token=test;object=0000;type=private"
Could not open file or uri for loading client certificate private key from pkcs11:token=test;object=0000;type=private
40578727C2720000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file
40578727C2720000:error:80000002:system library:file_open:No such file or directory:../providers/implementations/storemgmt/file_store.c:267:calling stat(pkcs11:token=test;object=0000;type=private)
40578727C2720000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=pkcs11
40578727C2720000:error:40000002:pkcs11:p11prov_ctx_status:Host out of memory error:provider.c:473:Module initialization failed!

Current configuration is:

root@host:~# cat /etc/openssl.cnf 
[openssl_init]
providers = providers

[providers]
default = provider_default
pkcs11 = provider_pkcs11

[provider_default]
activate = 1

[provider_pkcs11]
module = /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so
pkcs11-module-path = /usr/local/lib/softhsm/libsofthsm2.so
activate = 1

And the state of PKCS11:

root@host:~# pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so -l --pin 12345678 -O
Using slot 0 with a present token (0x100a7053)
Private Key Object; RSA 
  label:      test
  ID:         0000
  Usage:      decrypt, sign, signRecover, unwrap
  Access:     sensitive
Certificate Object; type = X.509 cert
  label:      test
  subject:    DN: C=CH, ST=Bern, O=example.org, OU=IT dept., CN=fips@example.org
  serial:     6D5FACE33F13C52FDB838E750B050AC74208D676
  ID:         0000
Public Key Object; RSA 2048 bits
  label:      test
  ID:         0000
  Usage:      encrypt, verify, verifyRecover, wrap
  Access:     none

[dengert]

I've already tried without -engine since I'm aware of it being a deprecated API. But many examples still use them.
That is because for years https://github.com/OpenSC/libp11 has been the engine that worked with OpenSSL,
but only recently has any work been done to support OpenSSL provider. In the last year or two, RedHat has developed https://github.com/latchset/pkcs11-provider and available on other distros.

What versions of OpenSSL, OpenSC and pkcs11-provider are you using?

I note that the pkcs11-tool -O -l --pin xxxxx
did not show the URI of objects like newer versions for example:

./pkcs11-tool -O -l --pin 123456
Using slot 0 with a present token (0x0)
Private Key Object; RSA 
  label:      PIV AUTH key
  ID:         01
  Usage:      decrypt, sign, signRecover, unwrap
  Access:     sensitive, always sensitive, never extractable, local
  uri:        pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=de0a61813810e7fc;token=ID-One%20PIV%20TEST%20CARD%202%20L;id=%01;object=PIV%20AUTH%20key;type=private
Public Key Object; RSA 2048 bits
  label:      PIV AUTH pubkey
  ID:         01
  Usage:      encrypt, verify, verifyRecover, wrap
  Access:     none
  uri:        pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=de0a61813810e7fc;token=ID-One%20PIV%20TEST%20CARD%202%20L;id=%01;object=PIV%20AUTH%20pubkey;type=public
Certificate Object; type = X.509 cert
  label:      Certificate for PIV Authentication
  subject:    DN: CN=ID-One PIV TEST CARD 2 L,OU=Identity & Security N.A.,O=IDEMIA,C=US
  serial:     5377A406
  ID:         01
  uri:        pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=de0a61813810e7fc;token=ID-One%20PIV%20TEST%20CARD%202%20L;id=%01;object=Certificate%20for%20PIV%20Authentication;type=cert

Another debugging tool for PICS11 is the OpenSC SPY https://github.com/OpenSC/OpenSC/wiki/Using-OpenSC

PKCS11 URI are defined in https://datatracker.ietf.org/doc/html/rfc7512

[fipscode]

Wow, thanks for you fast answer!
I'm using the versions in Ubuntu 24.04 with a self-compiled Softhsm2 (2.7.0):

openssl                3.0.13-0ubuntu3.7
pkcs11-provider:amd64  0.3-1build2
opensc                 0.25.0~rc1-1build2
opensc-pkcs11:amd64    0.25.0~rc1-1build2

I was already trying out pkcs11-spy, but, of course, had very bad luck with it...;)

root@host:~# export PKCS11SPY=/usr/local/lib/softhsm/libsofthsm2.so
root@host:~# pkcs11-tool --module /usr/lib/x86_64-linux-gnu/pkcs11-spy.so -I


*************** OpenSC PKCS#11 spy *****************
Loaded: "/usr/local/lib/softhsm/libsofthsm2.so"

0: C_GetInterface
P:125; T:0x129365389846528 2026-02-28 22:02:44.330
[in] pInterfaceName 0000582811d095ce / 7
    00000000  50 4B 43 53 20 31 31                             PKCS 11         
[in] pVersion = NULL
[in] flags = 
Segmentation fault (core dumped)

Interestingly, with PKCS11SPY=/usr/lib/x86_64-linux-gnu/libykcs11.so (for Yubikeys) there are no Segfaults...

URIs in the the output are great, maybe I'll self-compile OpenSC too.

[dengert]

Get the 00.27.0-rc1 https://github.com/OpenSC/OpenSC/releases

The C_GetInterface segfault sounds like OpenSC/OpenSC#3580
Does Softhsm2 (2.7.0): support PKCS11 3.x? I think Yubikey does.

Best to have OpenSC, OpenSSL, provider, and softhsm2 all use the same versions of OpenSSL. One way is to build and install to /usr/local
All of these source packages are hosted on github. And if you really want to get involved with any of them, use the github versions to keep up with changes and bugs.