Comment 18 for bug 2050017
Revision history for this message
| Andreas Hasenack (ahasenack) wrote Re: [FFe] [24.04 FEAT] [SEC2339] HSM protected signing support for Apache httpd for openSSL 3.0 with PKCS #11 provider | #18 |
I may have hit a bug elsewhere first, though. I'm following what I did for a pkcs11 engine test[1], but with the pkcs11-provider package. I'm able to create the RSA key in the softhsm2 token, and even generate a certificate request with it using openssl -provider pkcs11. But when I sign the request with the same key (nonsense, but technically valid), it does sign it, but core dumps at the end:
# openssl x509 -provider pkcs11 -signkey "pkcs11:
Enter pass phrase for PKCS#11 Token (Slot 460558707 - SoftHSM slot ID 0x1b739173):
Segmentation fault (core dumped)
# cat foo
-----BEGIN CERTIFICATE-----
MIICrzCCAZcCFHR
EjAQBgNVBAMMCW4
NDVaMBQxEjAQBgN
ADCCAQoCggEBAMC
4CE5dWp7X2RlGeZ
puyBE6GpYWDmUlY
TDcFnD+
/m7y8HGK29eto9c
47mWvtru/
AQEACgeFvFFyugM
ktdWRzbxJgIITll
HL4ibOcNNb2PKCJ
VnAnaSSkCRO9D5F
SRX06Fsk8mwD1I2
wuSORq/
-----END CERTIFICATE-----
The certificate looks ok, and a quick gdb on the core dump shows it was at shutdown time. But I'm also getting a core dump in apache now when configured to use this cert and hsm key. But also at shutdown. And while running, apache ssl isn't working. Still, it could be because softhsm2 usually requires root access, but I straced it and didn't see any EACCESS errors, and I also added the www-data user to the softhsm group.
Still, the segfault isn't good, and seems to be in either softhsm2 or pkcs11-provider, not apache itself.
1. https:/