PKCS11 / OpenSSL and n-of-m

Nitrokeys HSM
1

I’mt trying to get a setup with two Nitrokeys HSM automated.
HSM A contains the “root” key and is locked by a 2-of-3 scheme.

Currently I’m trying to setup openssl with PKCS11.
pkcs11-tool only detects the first key / slot on the device (–list-slots).
Is there any way pkcs11-tool finds all keys? - It does find all pub-keys and certificates on it (–list-objects). - Or is there some kind of alternative to use keys?

EDIT:
not even the slot which is displayed by pkcs11-tool is usable.
openssl […] -key key-uri-give-by-pkcs11-tool
returns “Could not find private key” - even if the HSM is unlocked. Trying the same command with a HSM only locked by a PIN works fine.

2

Did you try to setup hte HSM using the SmartCardShell?

3

Yes that works. Including the SCSH3gui - But as far as I understand that software can not create or sign certificates.

4

This is correct. One Nitrokey HSM is one slot. So --list-slots should show one entry for your Nitrokey HSM. You can use the slot number in the further commands if you have multiple devices attached.

This is also correct. Please add --login option and provide a PIN and the private keys will be displayed, too.

5

See Nitrokey HSM, n-of-m scheme and XCA - #3 by sc-hsm