-
|
Hi, The question is: is it possible to achieve this type of configuration (distributed VirtualHSM and EJBCA) in the Community Edition or can i only do this in the EE? If i can do it in this version, what should i do? are there any drivers for softhsm that i need to install? here i attach the docker-compose.yml that i use (before pointing to the tokens folder) |
Beta Was this translation helpful? Give feedback.
Replies: 10 comments 26 replies
-
|
I would use a volume mount, as you also need to mount the SoftHSM instance files with the actual keys in them, and probably want to share those between different containers? The DPoD example uses mounts, while the Fortanix one uses file system overlay. Have you pulled the latest EJBCA container so it is updated? |
Beta Was this translation helpful? Give feedback.
-
|
Correct, that guide uses an Enterprise feature. For now I'd recommend more the thing I pointed to. /usr/local/lib/softhsm/libsofthsm2.so This is from conf/web.properties.sample, which has all the default locations listed. |
Beta Was this translation helpful? Give feedback.
-
|
Finally i can see the PKCS11 option in the EJBCA Create Token page again. I've mounted the |
Beta Was this translation helpful? Give feedback.
-
|
Please tell me the right environments in order to configure SoftHSM successfully |
Beta Was this translation helpful? Give feedback.
-
|
You have to make sure your files are in the right place and readable. The error is from Java: Caused by: java.io.IOException: libcrypto.so.3: cannot open shared object file: No such file or directory/usr/local/lib/softhsm/libsofthsm2.so This means that Java can not open this file. Perhaps you have file system privileges that prevents Java from opening the file? |
Beta Was this translation helpful? Give feedback.
-
|
I think it is an environment issue because I put libsofthsm2.so and libcrypto.so.3 in a shared directory /softhsm-lib/lib that inside the container points to /usr/local/lib/softhsm and i can see them from the container but I'm still having that problem... Note that |
Beta Was this translation helpful? Give feedback.
-
|
I started the container with: I got the same issue as you. By enabling debug logging on the container I could see that EJBCA gets a response from softhsm, CKR_TOKEN_NOT_RECOGNIZED. This is a message from SoftHSM, meaning that it can't read the "token". |
Beta Was this translation helpful? Give feedback.
-
|
This stuff is blowing my mind... I have given all the needed permissions but still I'm having problems and the Debugger does not give me the same response. Actually, it does not give me anything that i do not already know. Plus i've installed the softhsm directly inside the host, without using a container for the softhsm but i'm getting the same result. is there a way to have better debug messages? |
Beta Was this translation helpful? Give feedback.
-
|
If you bash into the container and check all the files and paths, does everything list well? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, |
Beta Was this translation helpful? Give feedback.
-
|
It is not just me that is experiencing issues, I'm asking some colleagues to help me with this configuration and they have the same problems... |
Beta Was this translation helpful? Give feedback.
-
|
We are using softHSM on our Jenkins pipe-line to run system tests, and the tests run on the container built. So there is nothing in EJBCA or the container itself that prevents using softHSM. Are you sure your SoftHSM instance is initialized? Video support can only be offered with a SLA support subscription. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, could you at least have a look at this zip to see what is going on? because I have no other option, i have tried every single possibility. |
Beta Was this translation helpful? Give feedback.
-
|
Do like me and ssh into the container to investigate why your files can not be read. Also make sure you can actually use SoftHSM, to generate keys, outside of the container. I.e. make sure that your "slot" is initialized. According to: https://doc.primekey.com/ejbca/ejbca-integration/hardware-security-modules-hsm/softhsm |
Beta Was this translation helpful? Give feedback.
-
|
Actually I have done it already, on the ejbca container I bashed to check if the token folder and its subfolders could be read and written, and yes it is possible. I tried to create a dummy file and it let me do it. Only case A worked properly. But having a virtual-hsm inside the same container does not make much sense. |
Beta Was this translation helpful? Give feedback.
-
|
Option A is the only way I would do this and then volume mount the tokens inside of the container. Then you could volume mount that same directory inside other EJBCA containers for HA. Trying to use a separate container is adding a lot more complication and something we have never tried to do. SoftHSM is only for testing pkcs11. If you have a network based HSM or USB adding another layer to the EJBCA CE container to install the pkcs11 driver is the recommended way to proceed. You can try this for building the softhsm container: FROM centos:7 AS builder
WORKDIR /build
# Copy the configuration file into the container
COPY softhsm2.conf /etc/softhsm2.conf
RUN yum -y update && \
yum -y groupinstall "Development Tools" && \
yum -y install openssl-devel automake autoconf libtool pkgconfig openssl-devel && \
curl --silent -D - -L "https://github.com/opendnssec/SoftHSMv2/archive/refs/tags/2.6.1.tar.gz" -o SoftHSMv2-current.tar.gz && \
mkdir -p /build/softhsmv2 && \
tar -xf SoftHSMv2-current.tar.gz -C "/build/softhsmv2" --strip-components=1 && \
cd softhsmv2/ && \
./autogen.sh && \
./configure --disable-non-paged-memory --prefix=/usr && \
make -s && \
make -s install && \
# Create the directory for the tokens
mkdir -p /var/lib/softhsm/tokens && \
chgrp -R 0 /var/lib/softhsm/ /etc/softhsm2.conf && \
chmod -R g=u /var/lib/softhsm/ /etc/softhsm2.conf && \
chown -R 10001:0 /var/lib/softhsm/tokens
FROM centos:7
COPY --from=builder --chown=10001:0 /var/lib/softhsm/ /var/lib/softhsm/
COPY --from=builder --chown=10001:0 /usr/lib64/softhsm/libsofthsm2.so /usr/lib64/softhsm/libsofthsm2.so
COPY --from=builder --chown=10001:0 /usr/bin/softhsm2-keyconv /usr/bin/softhsm2-keyconv
COPY --from=builder --chown=10001:0 /usr/bin/softhsm2-util /usr/bin/softhsm2-util
COPY --from=builder --chown=10001:0 /usr/bin/softhsm2-dump-file /usr/bin/softhsm2-dump-file
COPY --from=builder --chown=10001:0 /etc/softhsm2.conf /etc/softhsm2.conf
# Create a volume for the tokens
VOLUME /var/lib/softhsm/tokens
# Set the environment variable for the configuration file
ENV SOFTHSM2_CONF="/etc/softhsm2.conf"
USER 10001:0
CMD ["tail", "-f", "/dev/null"]This sets all the permissions and user to what the EJBCA container would expect to see. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks so much, I will try this asap. |
Beta Was this translation helpful? Give feedback.
-
|
I have just configured the SoftHSM container as you suggested, but it still does not work along with the image
I am afraid I have not understood well, you mean that I should create a custom image of EJBCA and install the SoftHSM not only in a separate container, but ALSO inside the EJBCA container? Is that right? Another question that may or may not be related. @svenska-primekey here you say:
What do you mean by PKCS#11 driver? What should I install inside my EJBCA container? |
Beta Was this translation helpful? Give feedback.
-
|
Here is a container file to compile the softhsm and then add that into the EJBCA container. I tested this build and softhsm2 shows up under the pcks11 options. Make sure you mount a volume to for the tokens. After the container is started, exec into the container to create a a slot with the softhsm tool. Then you can access the UI and add the crypto token to EJBCA. FROM centos:7 AS builder
WORKDIR /build
# docker build -t ejbca-ce-softhsm:test -f Containerfile.sh .
# Copy the configuration file into the container
COPY softhsm2.conf /etc/softhsm2.conf
RUN yum -y update && \
yum -y groupinstall "Development Tools" && \
yum -y install openssl-devel automake autoconf libtool pkgconfig openssl-devel && \
curl --silent -D - -L "https://github.com/opendnssec/SoftHSMv2/archive/refs/tags/2.6.1.tar.gz" -o SoftHSMv2-current.tar.gz && \
mkdir -p /build/softhsmv2 && \
tar -xf SoftHSMv2-current.tar.gz -C "/build/softhsmv2" --strip-components=1 && \
cd softhsmv2/ && \
./autogen.sh && \
./configure --disable-non-paged-memory --prefix=/usr && \
make -s && \
make -s install && \
# Create the directory for the tokens
mkdir -p /var/lib/softhsm/tokens && \
chgrp -R 0 /var/lib/softhsm/ /usr/lib/softhsm/ /etc/softhsm2.conf && \
chmod -R g=u /var/lib/softhsm/ /usr/lib/softhsm/ /etc/softhsm2.conf && \
chown -R 10001:0 /var/lib/softhsm/tokens
FROM keyfactor/ejbca-ce:latest
USER 0:0
COPY --from=builder --chown=10001:0 /var/lib/softhsm/ /var/lib/softhsm/
COPY --from=builder --chown=10001:0 /usr/lib/softhsm/libsofthsm2.so /usr/lib/softhsm/libsofthsm2.so
COPY --from=builder --chown=10001:0 /usr/bin/softhsm2-keyconv /usr/bin/softhsm2-keyconv
COPY --from=builder --chown=10001:0 /usr/bin/softhsm2-util /usr/bin/softhsm2-util
COPY --from=builder --chown=10001:0 /usr/bin/softhsm2-dump-file /usr/bin/softhsm2-dump-file
COPY --from=builder --chown=10001:0 /etc/softhsm2.conf /etc/softhsm2.conf
# Create a volume for the tokens
VOLUME /var/lib/softhsm/tokens
# Set the environment variable for the configuration file
ENV SOFTHSM2_CONF="/etc/softhsm2.conf"
USER 10001:0To create some slots the command is like this: softhsm2-util --init-token --free --label RootCA --so-pin foo123 --pin foo123
softhsm2-util --init-token --free --label SubCA --so-pin foo123 --pin foo123The container file above would be very similar to install a PKCS11 client from a HSM vendor and then copy the pieces needed to the EJBCA container. This is a much better example to give you and hopefully clears up the confusion :-) |
Beta Was this translation helpful? Give feedback.
-
|
Oh ok now I understand. Thanks. Yeah that solution works.
So I understood that he was actually able to have SoftHSM2 inside his host and EJBCA inside a separate container (they just share the libraries, the tokens, and config file), that's why I was trying to repeat that case inside my machine but without success. |
Beta Was this translation helpful? Give feedback.
-
|
Yep, that works for me. What Sven is suggesting is definitely a cleaner solutions though. Will add some more verbosity to the documentation here: https://github.com/Keyfactor/keyfactorcommunity/tree/main/hsm-integration |
Beta Was this translation helpful? Give feedback.
-
|
Thanks guys for all your support, I have really appreciated that. Anyways there is another little doubt now, whenever I create a new slot at runtime: |
Beta Was this translation helpful? Give feedback.
-
|
Yes that is expected. The Sun P11 Provider loads everything at startup, and need a restart to load new things that are created outside of itself. |
Beta Was this translation helpful? Give feedback.
-
|
Hello @svenska-primekey @aleloco09 @primetomas , |
Beta Was this translation helpful? Give feedback.
-
|
That may be tricky. SoftHSM stores its stuff on files. You could always try to put those files on a common mounted filessystem. |
Beta Was this translation helpful? Give feedback.
-
|
@primetomas I have this problem when i wanna create a crypto token with Pkcs11 on ejbca interface . 2025-01-09 16:41:02,363+0000 ERROR [com.keyfactor.util.keys.token.pkcs11.SunP11SlotListWrapper] (default task-10) Method sun.security.pkcs11.wrapper.PKCS11.CK_C_INITIALIZE_ARGS.getInstance was not accessible, this may be due to a change in the underlying library.: java.lang.IllegalAccessException: class com.keyfactor.util.keys.token.pkcs11.SunP11SlotListWrapper cannot access class sun.security.pkcs11.wrapper.PKCS11 (in module jdk.crypto.cryptoki) because module jdk.crypto.cryptoki does not export sun.security.pkcs11.wrapper to unnamed module @7c10ea75 |
Beta Was this translation helpful? Give feedback.
-
|
@primetomas |
Beta Was this translation helpful? Give feedback.
-
|
I'm going to have to ask another dev. I don't know the code at that level. Let me see what I can find out. |
Beta Was this translation helpful? Give feedback.
-
|
@svenska-primekey Okay , thanks you I stay tuned. |
Beta Was this translation helpful? Give feedback.
-
|
@svenska-primekey @primetomas Hello, |
Beta Was this translation helpful? Give feedback.
-
|
Can you start another thread on this topic. This thread as started by aleloco was been marked as answered. You can still mark us all in the new topic. |
Beta Was this translation helpful? Give feedback.
Thanks guys for all your support, I have really appreciated that.
Thanks to your prompts, I have actually managed to run SoftHSM and EJBCA in 2 separated containers.
Bashing on the EJBCA container, I have
lddonlibsofthsm2.soand there was a dependency problem:libcrypto.so.10was missing.To overcome this, on the Dockerfile suggested by Sven that lib should be copied as well from the builder:
COPY --from=builder --chown=10001:0 /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.10Anyways there is another little doubt now, whenever I create a new slot at runtime:
softhsm2-util --init-token --free --label RootCA --so-pin foo123 --pin foo123In order to see it from the webapp, I need to r…