Unable to import keys to Nitrokey HSM

Nitrokeys HSM
1

I have a Nitrokey HSM, connected to a linux box (Ubuntu 24.04) with only terminal access (no gui).
I have initialised the device and can generate keys but am unable to import keys. I have attempted the following:

sudo pkcs11-tool --module opensc-pkcs11.so -l --pin --write-object ca/pkcs8/ca.der --type privkey --id 01 --label “”
with the following error:
Using slot 0 with a present token (0x0)
**error: PKCS11 function C_CreateObject failed: rv = CKR_FUNCTION_NOT_SUPPORTED (0x54) **
Aborting.

Is a firmware update required or is key import not implemented on this generation of the Nitrokey HSM. BTW, I am not sure whether the Nitrokey I have is v1 or v2

Thanks in advance for any assistance …

The Nitrokey data is below…:

Slot 0 (0x0): Nitrokey Nitrokey HSM (DENK04003970000 ) 00 00
token label : SmartCard-HSM (UserPIN)
token manufacturer : www.CardContact.de
token model : PKCS#15 emulated
token flags : login required, rng, token initialized, PIN initialized
hardware version : 24.13
firmware version : 4.1
serial num : DENK0400397
pin min/max : 6/15

2

The only way found was by making a p12 file first and import this via the GUI tool. I didn’t find a way do to it from the command line. It seems you also need to setup the HSM to create upfront empty key domains as with each import you need an empty key domain. Only when performing multiple imports in a single go you can import multiple keys in one key domain. But the next time you start importing again it will need an empty key domain again.
When creating many empty key domains the HSM feels slow as it seems it needs to iterate over all every time you interact with the HSM.

3

You can do this with the smartcard shell (“the GUI tool”) JavaScript as well, it does not have to be interactive GUI…