You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We are using the Utimaco Security server simulator for our secure image signing. During our regression test, we observe that openssl egnine -> pkcs11.so does not invoke the pkcs11 C_CloseAllSessions/C_CloseSession call, causing the server exceed the connection limit. By looking at the libp11 signing code, I do not see C_CloseAllSessions/C_CloseSession call. Please check and confirm this issue.
The text was updated successfully, but these errors were encountered:
jamyam
changed the title
openssl engine pkcs11 signing does not invoke C_CloseAllSessions/C_CloseAllSessions call
openssl engine pkcs11 signing does not invoke C_CloseAllSessions/C_CloseSession call
Mar 3, 2025
We are using the Utimaco Security server simulator for our secure image signing. During our regression test, we observe that openssl egnine -> pkcs11.so does not invoke the pkcs11 C_CloseAllSessions/C_CloseSession call, causing the server exceed the connection limit. By looking at the libp11 signing code, I do not see C_CloseAllSessions/C_CloseSession call. Please check and confirm this issue.
// A openssl command example:
openssl rand 1024 > ~/fip.bin
openssl dgst -engine pkcs11 -sign "pkcs11:token=CryptoServer PKCS11 Token;object=MCU_SecureImage_SigningKey00;type=private" -keyform engine -sha256 -out ~/fip.bin.sig ~/fip.bin; xxd ~/fip.bin.sig
// pkcs11 log from the server side
03.03.2025 08:53:30.729 | [00353860:00353860] C_FindObjectsInit | T: enter C_FindObjectsInit(hSession: 0x00000001, pTemplate: CK_ATTRIBUTE[2])
03.03.2025 08:53:30.729 | [00353860:00353860] C_FindObjectsInit | T: Attributes in: 2
CKA_CLASS:
CKA_ID:
03.03.2025 08:53:30.729 | [00353860:00353860] C_FindObjectsInit | T: leave C_FindObjectsInit()
03.03.2025 08:53:30.729 | [00353860:00353860] C_FindObjects | T: enter C_FindObjects(hSession: 0x00000001, ulMaxObjectCount: 0x00000001)
03.03.2025 08:53:30.729 | [00353860:00353860] C_FindObjects | T: leave C_FindObjects()
03.03.2025 08:53:30.729 | [00353860:00353860] C_FindObjectsFinal | T: enter C_FindObjectsFinal(hSession: 0x00000001)
03.03.2025 08:53:30.729 | [00353860:00353860] C_FindObjectsFinal | T: leave C_FindObjectsFinal()
03.03.2025 08:53:30.729 | [00353860:00353860] C_GetSessionInfo | T: enter C_GetSessionInfo(hSession: 0x00000001)
03.03.2025 08:53:30.729 | [00353860:00353860] C_GetSessionInfo | T: leave C_GetSessionInfo()
03.03.2025 08:53:30.729 | [00353860:00353860] C_SignInit | T: enter C_SignInit(hSession: 0x00000001, pMechanism: CKM_ECDSA (0x1041), hKey: 0x00000001)
03.03.2025 08:53:30.729 | [00353860:00353860] C_SignInit | T: leave C_SignInit()
03.03.2025 08:53:30.729 | [00353860:00353860] C_Sign | T: enter C_Sign(hSession: 0x00000001)
03.03.2025 08:53:30.730 | [00353860:00353860] C_Sign | T: leave C_Sign()
The text was updated successfully, but these errors were encountered: