Interesting. I added the Utimaco to the list of supported modules (CS.cfg - preop.configModules). This time it showed up in the list in the supported section along with the "Login" tag. I clicked "Login" and manually logged in, selected the module as the default, and completed the enrollment. I then went back to the HSM and using the Utimaco provided tool confirmed all the keys etc are present. zcoolkey showed up in the unsupported list. So try: Add utimaco to the pkicreate script in /usr/bin Add utimaco to the supported list in the default CS.cfg /usr/share/pki/ca/conf Mike On 4/27/2010 9:51 PM, Michael StJohns wrote:
OK -
Using my recompiled/relinked version of the Utimaco library on Fedora 12 - 32 bit.
I can consistently get the Utimaco library to show up in the list with the three slots I've initialized. BUT - none of those show up with the "Login" button.
The reason I couldn't get it to work before was because of the coolkey library... if that libary is loaded (name "coolkey"), modutil and TokenInfo both see it, but only the coolkey library gets listed on the setup page.
I deleted the coolkey library, restarted the server and the Utimaco slots showed up.
I re-added the coolkey library with the name "zcoolkey", restarted the server - only the Utimaco slots showed up.
- At this point I got suspicious and tried one more thing.
I deleted the Utimaco library with the name "utimaco", restarted the server. The zcoolkey library showed up.
Hmm..... looks like for some reason, only the first module (alphabetically) is being listed/loaded.
Mike
On 4/27/2010 8:51 PM, Arshad Noor wrote:
Was this on a 32-bit or 64-bit environment, Mike? I was planning to test this with the 32-bit version of Fedora 11, based on your assertion that it worked. But, now it appears that this might be unpredictable. Is that right?
Arshad Noor StrongAuth, Inc.
Michael StJohns wrote:
On 4/26/2010 10:46 PM, Christina Fu wrote:
Actually, I did spend some time looking into JSS code. The result was inconclusive. The code appeared to be reasonable. I do suspect, however, without looking closely at the code, that somehow the module is unloaded somewhere along the way. I'm curious whether this is an issue on this particular HSM, or if it's a matter of handling external modules (including software modules) in general. Has anyone had any success installing/using certicom module on this platform, for example?
Again, I did not see any email from another member (StJohns?) that you mentioned claiming success with Utimaco HSM on a 32 bit machine... could you please forward the email? Another thing is, I'm not familiar with Utimaco HSM, but you might want to find out how to turn on debugger.
Otherwise, try turning on NSS debugging, which might give you some clue.
Christina
Hi Christina -
I had to put work on this aside for a few days, but am getting back to it. I've had uneven results. The time that I got the HSM to show up with the slots, but I didn't get the "Login" button. This time, I didn't even get the HSM to show up. The first time, I added the HSM manually, the second via a mod to the create script. Still working my way through it.
I modified pki_create_instance to add both the Utimaco library and the Coolkey PKCS11 libary. I had to turn off SELinux enforcement to get Coolkey to show up on the list, but even then, the Utimaco lib didn't. I haven't had a chance to go back and check again.
Mike
_______________________________________________ Pki-users mailing list Pki-users@redhat.com https://www.redhat.com/mailman/listinfo/pki-users