XCA cannot properly access a YubiHSM2 (login issues maybe) about xca HOT 8 OPEN

Maybe related to #43 (comment)

So, the solution would be to check if the key on token is CKA_ALWAYS_AUTHENTICATE, and do C_Login(CKU_CONTEXT_SPECIFIC,...)

Maybe I will find the time to look into it, soon.

from xca.

Thanks for the hints.
However, I did not succeed in either of them. Trying to create a key pair with pkcs11-tool using the --always-auth flag gives me this error:
error: PKCS11 function C_GenerateKeyPair failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

Regarding the opensc.conf options, I am unsure if the YubiHSM PKCS#11 driver even uses the pin_cache_ignore_user_consent = true; option.

So, I would really appreciate if you could look into it, as I am a bit lost right now.

from xca.

Either the keypair hasn't been created completely (Public and private key object), see: https://hohnstaedt.de/xca-doc/html/smartcard.html#key-management-on-the-token .
Did you create the keys with XCA or with an other tool and then import them into XCA?
Do you see the created keys when you select "Manage Security token" ?

from xca.

Hi, I contacted Yubico about this, and this is what they answered:
When we are testing the XCA tool it seems like it is not able to establish a session using the yubihsm_pkcs11 module.
The reason is likely that the YubiHSM2 does not support the SO-PIN concept, as is stated in the YubiHSM2 PKCS#11 documentation, and it seems like all the interactions to sign in is using the SO PIN, rather than the regular PIN.

Could this help with adressing this issue within XCA?

from xca.

Added login option with 3457454
Please try a build from https://github.com/chris2511/xca/actions/runs/8195398369

from xca.

Dear Chris,
thanks a lot for providing the additional login option so fast! I tested the build, but however, XCA just stalls and has to be force-closed after entering the PIN. I am attaching the PCKS11 log for one XCA session, so if you could have a look at it, that would be great:
yubiHSM.txt

from xca.

Auto close with 3457454 was not correct

from xca.

Dear Chris,
may I kindly ask if there are any news on this issue?

from xca.