# Nitrokey & PKCS11 via OpenSSL on macOS Sierra

**URL:** https://support.nitrokey.com/t/nitrokey-pkcs11-via-openssl-on-macos-sierra/417
**Category:** Nitrokeys
**Created:** [March 24, 2017, 7:26pm UTC](https://support.nitrokey.com/t/nitrokey-pkcs11-via-openssl-on-macos-sierra/417 "2017-03-24T19:26:45Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![prometheus](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/p/df788c/32.png) [@prometheus](https://support.nitrokey.com/u/prometheus)
#### Post date: [March 24, 2017, 7:26pm UTC](https://support.nitrokey.com/t/nitrokey-pkcs11-via-openssl-on-macos-sierra/417/1 "2017-03-24T19:26:46Z")

</div>

Dear Nitrokey Support

The integration of OpenSC’s PKCS11 engine for OpenSSL works, but when I try to create a self-signed certificate with it, I get the following error:

```
OpenSSL> engine -t dynamic -pre SO_PATH:/usr/local/Cellar/engine_pkcs11/0.1.8/lib/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/local/Cellar/opensc/0.16.0/lib/pkcs11/opensc-pkcs11.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/local/Cellar/engine_pkcs11/0.1.8/lib/engines/engine_pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/local/Cellar/opensc/0.16.0/lib/pkcs11/opensc-pkcs11.so
Loaded: (pkcs11) pkcs11 engine
     [available]
OpenSSL>
OpenSSL>
OpenSSL>
OpenSSL> req -engine pkcs11 -new -keyform engine -out cert.pem -text -x509 -days 3640 -key label_test -subj '/CN=test'
engine "pkcs11" set.
failed to enumerate slots
PKCS11_get_private_key returned NULL
cannot load Private Key from engine
140735752430600:error:80002030:PKCS11 library:PKCS11_enum_slots:Device error:p11_slot.c:312:
140735752430600:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:eng_pkey.c:124:
unable to load Private Key
error in req

```

Do you have any hint for me? What is probably going wrong?

Nitrokey information:

- Nitrokey Pro
- Firmware version: 0.8

Thx & best wishes

---

<div class="post-metadata">

### Author: ![prometheus](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/p/df788c/32.png) [@prometheus](https://support.nitrokey.com/u/prometheus)
#### Post date: [March 27, 2017, 11:57am UTC](https://support.nitrokey.com/t/nitrokey-pkcs11-via-openssl-on-macos-sierra/417/2 "2017-03-27T11:57:29Z")

</div>

In addition, creating new RSA keys (2048 & 4096) via the pkcs11-tool doesn’t work yet as well. In both cases, I get the following exceptions:

- RSA 2048 =\> error: PKCS11 function C\_GenerateKeyPair failed: rv = CKR\_USER\_NOT\_LOGGED\_IN (0x101)
- RSA 4096 =\> error: PKCS11 function C\_GenerateKeyPair failed: rv = CKR\_FUNCTION\_NOT\_SUPPORTED (0x54)

Here are some fragments of the logs (with OpenSC log level = 9):

- **RSA 2048 case:**

- **RSA 4096**  **case**

It seems that 4096 bit keys are not supported, but they should be supported.

Thx for any hints & best wishes

---

<div class="post-metadata">

### Author: ![jan](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/j/ce7236/32.png) [@jan](https://support.nitrokey.com/u/jan)
#### Post date: [March 29, 2017, 7:26am UTC](https://support.nitrokey.com/t/nitrokey-pkcs11-via-openssl-on-macos-sierra/417/3 "2017-03-29T07:26:50Z")

</div>

Since this is about OpenSC’s details, could you ask at the OpenSC  
mailinglist or submit a Github ticket, please?

---

<div class="post-metadata">

### Author: ![prometheus](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/p/df788c/32.png) [@prometheus](https://support.nitrokey.com/u/prometheus)
#### Post date: [April 3, 2017, 8:11am UTC](https://support.nitrokey.com/t/nitrokey-pkcs11-via-openssl-on-macos-sierra/417/4 "2017-04-03T08:11:45Z")

</div>

Hi Jan

Thx for your reply. I’ve created a new OpenSC [ticket](https://github.com/OpenSC/OpenSC/issues/1011).

Thx & best wishes