I’mt trying to get a setup with two Nitrokeys HSM automated.
HSM A contains the “root” key and is locked by a 2-of-3 scheme.
Currently I’m trying to setup openssl with PKCS11.
pkcs11-tool only detects the first key / slot on the device (–list-slots).
Is there any way pkcs11-tool finds all keys? - It does find all pub-keys and certificates on it (–list-objects). - Or is there some kind of alternative to use keys?
EDIT:
not even the slot which is displayed by pkcs11-tool is usable.
openssl […] -key key-uri-give-by-pkcs11-tool
returns “Could not find private key” - even if the HSM is unlocked. Trying the same command with a HSM only locked by a PIN works fine.