<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12px"><div id="yiv0783084310"><div id="yui_3_16_0_1_1430628063334_254179"><div id="yui_3_16_0_1_1430628063334_254178" style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12px;"><div id="yiv0783084310yui_3_16_0_1_1430628063334_252401">Hi,</div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252657"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252619" dir="ltr"><div id="yui_3_16_0_1_1430628063334_254547" dir="ltr">I am trying to set up smart card authentication in Strongswan using the software token (swtok) in OpenCryptoki. Strongswan loads the swtok, but it is not able to find the pkcs11 lib by keyid (find_lib_by_keyid fails based on debug messages I added). I am not sure what is the keyid to be put in ipsec.secrets? Found a reference that says it has to be CKA_ID, but not sure how to derive it from the key/cert file? The ipsec.secrets examples seem to use a simple number like 50. Could someone please help me?<br></div></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252774" dir="ltr"><div id="yui_3_16_0_1_1430628063334_254577"><br></div><div id="yui_3_16_0_1_1430628063334_254705">Here is the error I am getting. (Complete log below).</div><div id="yui_3_16_0_1_1430628063334_254703"><br></div></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252800" dir="ltr">May 5 15:34:29 ws-us charon: 00[CFG] find_lib_by_keyid: found PKCS#11 token 'my-opencryptoki-module': slot 3, current 3<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] find_lib_by_keyid exiting<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] no PKCS#11 module found having a keyid 01<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[LIB] building CRED_PRIVATE_KEY - (0) failed, tried 3 builders<br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252659" dir="ltr"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252720" dir="ltr">ipsec.secrets:</div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252674" dir="ltr"> PIN %smartcard3:01 "xxxxxx"<br style="" class="yiv0783084310"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252552" dir="ltr">Strongswan.conf looks like this:</div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252498" dir="ltr"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252500" dir="ltr"> plugins {<br style="" class="yiv0783084310"><br style="" class="yiv0783084310"> pkcs11 {<br style="" class="yiv0783084310"><br style="" class="yiv0783084310"> modules {<br style="" class="yiv0783084310"> my-opencryptoki-module {<br style="" class="yiv0783084310"> path = /usr/local/lib/pkcs11/PKCS11_API.so<br style="" class="yiv0783084310"> }<br style="" class="yiv0783084310"> }<br style="" class="yiv0783084310"> }<br style="" class="yiv0783084310"> }<br style="" class="yiv0783084310">}<br style="" class="yiv0783084310"></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252529" dir="ltr"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252528" dir="ltr">I have loaded the privkey.der and cert.der into the software token using pkcs11-tool.</div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252566" dir="ltr"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252574" dir="ltr">[root@localhost usr]# pkcs11-tool --module /usr/lib64/pkcs11/libopencryptoki.so --list-objects --login --pin xxxx<br style="" class="yiv0783084310">Using slot 0 with a present token (0x3)<br style="" class="yiv0783084310">Private Key Object; RSA<br style="" class="yiv0783084310"> label: test<br style="" class="yiv0783084310"> ID: 01<br style="" class="yiv0783084310"> Usage: decrypt, sign, unwrap<br style="" class="yiv0783084310"><br style="" class="yiv0783084310">Certificate Object, type = X.509 cert<br style="" class="yiv0783084310"> label: test<br style="" class="yiv0783084310"> ID: 01<br style="" class="yiv0783084310">[root@localhost usr]#<br style="" class="yiv0783084310"></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252678" dir="ltr"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252689" dir="ltr">Complete Messages Log:</div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252884" dir="ltr"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252912" dir="ltr">May 5 15:34:28 ws-us charon: 00[DMN] Starting IKEv2 charon daemon (strongSwan 4.5.3) <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[LIB] plugin 'aes': loaded successfully <br style="" class="yiv0783084310">::::<br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[LIB] plugin 'gmp': loaded successfully <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] loaded PKCS#11 v2.20 library 'my-opencryptoki-module' (/usr/local/lib/pkcs11/PKCS11_API.so) <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] IBM: Meta PKCS11 LIBRARY v3.2 <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] uses OS locking functions <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] found token in slot 'my-opencryptoki-module':3 (Linux) <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SWToken (IBM Corp.: IBM SoftTok) <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] RSA_PKCS_KEY_PAIR_GEN 512-4096 [ GEN_KEY_PAIR ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES_KEY_GEN 8-8 [ GEN ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES3_KEY_GEN 24-24 [ GEN ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] RSA_PKCS 512-4096 [ ENCR DECR SIGN SIGN_RCVR VRFY VRFY_RCVR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] RSA_PKCS_PSS 1024-4096 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA1_RSA_PKCS_PSS 1024-4096 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA256_RSA_PKCS_PSS 1024-4096 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA384_RSA_PKCS_PSS 1024-4096 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA512_RSA_PKCS_PSS 1024-4096 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] RSA_X_509 512-4096 [ ENCR DECR SIGN SIGN_RCVR VRFY VRFY_RCVR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] RSA_PKCS_OAEP 1024-4096 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] MD5_RSA_PKCS 512-4096 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA1_RSA_PKCS 512-4096 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DH_PKCS_DERIVE 512-2048 [ DERIVE ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DH_PKCS_KEY_PAIR_GEN 512-2048 [ GEN_KEY_PAIR ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES_ECB 8-8 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES_CBC 8-8 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES_CBC_PAD 8-8 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES3_ECB 24-24 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES3_CBC 24-24 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] DES3_CBC_PAD 24-24 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA_1 0-0 [ DGST ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA_1_HMAC 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA_1_HMAC_GENERAL 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA256 0-0 [ DGST ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA256_HMAC 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA256_HMAC_GENERAL 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA384 0-0 [ DGST ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA384_HMAC 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA384_HMAC_GENERAL 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA512 0-0 [ DGST ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA512_HMAC 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SHA512_HMAC_GENERAL 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] MD5 0-0 [ DGST ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] MD5_HMAC 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] MD5_HMAC_GENERAL 0-0 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SSL3_PRE_MASTER_KEY_GEN 48-48 [ GEN ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SSL3_MASTER_KEY_DERIVE 48-48 [ DERIVE ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SSL3_KEY_AND_MAC_DERIVE 48-48 [ DERIVE ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SSL3_MD5_MAC 384-384 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] SSL3_SHA1_MAC 384-384 [ SIGN VRFY ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] AES_KEY_GEN 16-32 [ GEN ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] AES_ECB 16-32 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] AES_CBC 16-32 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[CFG] AES_CBC_PAD 16-32 [ ENCR DECR WRAP UNWRAP ] <br style="" class="yiv0783084310">May 5 15:34:28 ws-us charon: 00[LIB] plugin 'pkcs11': loaded successfully <br style="" class="yiv0783084310">:::<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] loading secrets from '/usr/local/etc/ipsec.secrets' <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] loaded IKE secret for %any <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] secret: 73:70:69:64:65:72:63:6c:6f:75:64 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] find_lib_by_keyid: found PKCS#11 token 'my-opencryptoki-module': slot 3, current 3 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] find_lib_by_keyid exiting <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[CFG] no PKCS#11 module found having a keyid 01 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[LIB] building CRED_PRIVATE_KEY - (0) failed, tried 3 builders <br style="" class="yiv0783084310">:::<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[DMN] loaded plugins: aes des sha1 sha2 md5 random x509 revocation constraints pubkey pkcs1 pgp pem fips-prf gmp pkcs11 xcbc hmac attr kernel-netlink resolve socket-raw stroke updown <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 00[JOB] spawning 16 worker threads <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 02[CFG] module 'my-opencryptoki-module' does not support hot-plugging, cancelled <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] received stroke: add connection 'conn-whale-cert' <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] conn conn-whale-cert <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] left=10.1.11.81 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftsubnet=172.16.1.0/24 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftsourceip=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftauth=pubkey <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftauth2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftid=@test.testdom.com <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftid2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftcert=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftcert2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftca=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftca2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftgroups=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] leftupdown=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] right=10.1.11.15 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightsubnet=192.168.1.0/24 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightsourceip=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightauth=pubkey <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightauth2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightid=@whale.testdom.com <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightid2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightcert=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightcert2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightca=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightca2=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightgroups=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] rightupdown=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] eap_identity=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] aaa_identity=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] ike=aes128-sha1-aesxcbc-modp2048! <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] esp=aes128-3des-null-sha1-aesxcbc-modp1024-modp2048! <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] dpddelay=30 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] dpdaction=0 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] closeaction=0 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] mediation=no <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] mediated_by=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] me_peerid=(null) <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[KNL] getting interface name for 10.1.11.15 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[KNL] 10.1.11.15 is not a local address <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[KNL] getting interface name for 10.1.11.81 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[KNL] 10.1.11.81 is on interface eth0 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 10[CFG] added configuration 'conn-whale-cert' <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 11[CFG] received stroke: initiate 'conn-whale-cert' <br style="" class="yiv0783084310">::<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 11[IKE] initiating IKE_SA conn-whale-cert[1] to 10.1.11.15 <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 11[IKE] IKE_SA conn-whale-cert[1] state change: CREATED => CONNECTING <br style="" class="yiv0783084310">::<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 11[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] <br style="" class="yiv0783084310">::<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 13[NET] received packet: from 10.1.11.15[500] to 10.1.11.81[500] <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 13[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ] <br style="" class="yiv0783084310">::<br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 13[IKE] no private key found for 'test.testdom.com' <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 13[MGR] checkin and destroy IKE_SA conn-whale-cert[1] <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 13[IKE] IKE_SA conn-whale-cert[1] state change: CONNECTING => DESTROYING <br style="" class="yiv0783084310">May 5 15:34:29 ws-us charon: 13[MGR] check-in and destroy of IKE_SA successful <br style="" class="yiv0783084310"></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_253043" dir="ltr"><br></div><div dir="ltr">Thanks</div><div id="yui_3_16_0_1_1430628063334_254796" dir="ltr">Kandy</div><div dir="ltr"><br></div><div id="yiv0783084310yui_3_16_0_1_1430628063334_252750" dir="ltr"><br></div></div></div></div></div></body></html>