OpenSSL无法使用PKCS11-URI问题排查求助

问题详情 #

尝试通过PKCS11-URI使用tpm2_ptool创建的TPM2 RSA密钥生成证书签名请求（CSR）时，出现以下错误：

Could not open file or uri for loading private key from pkcs11:model=SLB9670%00%00%00%00%00%00%00%00%00;manufacturer=Infineon;serial=0000000000000000;token=tokenname;id=%66%66%31%34%31%66%35%38%35%38%64%33%62%37%62%64;object=objectname;type=private;pin-value=userpin
40C7C3379C7F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file
40C7C3379C7F0000:error:80000002:system library:file_open:No such file or directory:../providers/implementations/storemgmt/file_store.c:267:calling stat(pkcs11:model=SLB9670%00%00%00%00%00%00%00%00%00;manufacturer=Infineon;serial=0000000000000000;token=tokenname;id=%66%66%31%34%31%66%35%38%35%38%64%33%62%37%62%64;object=objectname;type=private;pin-value=userpin)
40C7C3379C7F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=pkcs11
40C7C3379C7F0000:error:1608010C:STORE routines:inner_loader_fetch:unsupported:../crypto/store/store_meth.c:359:No store loader found. For standard store loaders you need at least one of the default or base providers available. Did you forget to load them? Info: Global default library context, Scheme (pkcs11 : 0), Properties (?provider=tpm2)

操作步骤 #

export PKCS11_MODULE="/usr/lib/x86_64-linux-gnu/pkcs11/libtpm2_pkcs11.so"
export OPENSSL_CONF="/root/openssl.cnf"
TPM2_PKCS11_STORE=/root/.tpm2_pkcs11
GNUTLS_PIN=userpin
GNUTLS_SO_PIN=sopin
LABEL="tokenname"
KEY_LABEL="objectname"

rm -v -R "${TPM2_PKCS11_STORE}" 2>/dev/null

tpm2_ptool init
tpm2_ptool addtoken --pid=1 --sopin="${GNUTLS_SO_PIN}" --userpin="${GNUTLS_PIN}" --label="${LABEL}"
tpm2_ptool addkey --algorithm=rsa2048 --label="${LABEL}" --key-label="${KEY_LABEL}" --userpin="${GNUTLS_PIN}"

pkcs11-tool --module "${PKCS11_MODULE}" -L

# 输出：
# WARNING: Getting tokens from fapi backend failed.
# Available slots:
# Slot 0 (0x1): tokenname
#   token label        : tokenname
#   token manufacturer : Infineon
#   token model        : SLB9670
#   token flags        : login required, rng, token initialized, PIN initialized
#   hardware version   : 1.38
#   firmware version   : 7.85
#   serial num         : 0000000000000000
#   pin min/max        : 0/128
# Slot 1 (0x2): 
#   token state:   uninitialized

pkcs11-tool --module "${PKCS11_MODULE}" -O

# 输出：
# WARNING: Getting tokens from fapi backend failed.
# Using slot 0 with a present token (0x1)
# Public Key Object; RSA 2048 bits
#   label:      objectname
#   ID:         66663134316635383538643362376264
#   Usage:      encrypt, verify
#   Access:     local

TOKEN=$(p11tool --list-token-urls | grep "token=${LABEL}")

# TOKEN: pkcs11:model=SLB9670%00%00%00%00%00%00%00%00%00;manufacturer=Infineon;serial=0000000000000000;token=tokenname

p11tool --login --list-all "${TOKEN}" --outfile p11tool.out
PRIVATE_KEY="$(cat p11tool.out | grep private | awk '{ print $2 }')"

# PRIVATE_KEY: 'pkcs11:model=SLB9670%00%00%00%00%00%00%00%00%00;manufacturer=Infineon;serial=0000000000000000;token=tokenname;id=%66%66%31%34%31%66%35%38%35%38%64%33%62%37%62%64;object=objectname;type=private'

openssl req \
-new \
-provider tpm2 \
-provider default \
-propquery "?provider=tpm2" \
-key "${PRIVATE_KEY};pin-value=${GNUTLS_PIN}" \
-out "$(hostname).csr" \
-verbose

系统信息 #

• 系统：Ubuntu 22.04
• 内核：5.15.0-94-generic #104-Ubuntu SMP Tue Jan 9 15:25:40 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
• OpenSSL版本：OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
• OpenSSL引擎：

  (rdrand) Intel RDRAND engine
       [ available ]
  (dynamic) Dynamic engine loading support
       [ unavailable ]
  (pkcs11) pkcs11 engine
       [ available ]
  

问题原因及解决方案 #

核心原因 #

错误提示unregistered scheme:pkcs11和No store loader found，说明当前OpenSSL环境没有注册PKCS11协议的加载器。OpenSSL 3.0采用provider模型，默认的default/base provider不支持PKCS11 URI的解析，而你加载的tpm2 provider也未提供对应的PKCS11 store支持。

解决方案1：使用PKCS11 Engine调用密钥 #

直接使用已安装的pkcs11 engine替代provider方式，命令调整为：

openssl req \
-new \
-engine pkcs11 \
-keyform engine \
-key "pkcs11:token=${LABEL};object=${KEY_LABEL};pin-value=${GNUTLS_PIN}" \
-subj "/CN=$(hostname)" \
-out "$(hostname).csr" \
-verbose

注：-subj参数可直接指定证书主题，避免交互式输入，根据实际需求修改。

解决方案2：配置PKCS11 Provider #

1. 安装PKCS11 Provider包：

   apt update && apt install -y openssl-pkcs11
   

2. 修改openssl.cnf，添加PKCS11 Provider配置：

   [provider_sect]
   default = default_sect
   pkcs11 = pkcs11_sect
   
   [default_sect]
   activate = 1
   
   [pkcs11_sect]
   activate = 1
   module = /usr/lib/x86_64-linux-gnu/ossl-modules/libpkcs11.so
   

3. 重新运行OpenSSL命令：

   openssl req \
   -new \
   -provider pkcs11 \
   -provider default \
   -propquery "?provider=pkcs11" \
   -key "${PRIVATE_KEY};pin-value=${GNUTLS_PIN}" \
   -subj "/CN=$(hostname)" \
   -out "$(hostname).csr" \
   -verbose
   

额外优化建议 #

• PKCS11 URI中的model=SLB9670%00%00%00%00%00%00%00%00%00包含多余的空字符编码%00，可简化为model=SLB9670，避免部分工具解析异常。
• 确保libtpm2_pkcs11.so路径正确，且当前用户对该文件及TPM设备有访问权限。

内容的提问来源于stack exchange，提问作者TR-eenet