升级OpenSSL3后Yubico私钥证书签名功能失效求助

将PKI CA证书与私钥存储在Yubikey中，原本使用OpenSSL 1可正常签发终端用户证书，但升级至OpenSSL 3后该功能失效。已更新pkcs11引擎路径，其余内容未变；手动执行命令时pkcs11引擎注册成功，但签名操作失败。尝试用token uri替代slot+ID的方式，问题仍未解决。

原OpenSSL 1下正常运行的签名脚本 #

pki_path=~/pki/paul
pin=$(cat ~/yubico/pin.txt)
echo "Yubico PIN: $pin"
openssl engine dynamic -pre SO_PATH:/usr/lib/engines-3/pkcs11.so -pre ID:pkcs11 -pre NO_VCHECK:1 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/opensc-pkcs11.so -pre VERBOSE
openssl x509 -engine pkcs11 -CAkeyform engine -CAkey slot_0-id_2 -sha384 -CA $pki_path/ca.crt -req -passin pass:$pin -in $pki_path/reqs/$2.req -extfile x509-types/$1 -days 365 -out $pki_path/issued/$2.crt
cat $pki_path/issued/$2.crt $pki_path/ca.crt > $pki_path/bundle/$2.crt

手动执行的错误输出 #

pkcs11引擎注册成功：

λ ~/pki/scripts/ openssl engine dynamic -pre SO_PATH:/usr/lib/engines-3/pkcs11.so -pre ID:pkcs11 -pre NO_VCHECK:1 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib/opensc-pkcs11.so -pre VERBOSE
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib/engines-3/pkcs11.so
[Success]: ID:pkcs11
[Success]: NO_VCHECK:1
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/lib/opensc-pkcs11.so
[Success]: VERBOSE
Loaded: (pkcs11) pkcs11 engine

签名操作失败，关键错误为Failed to enumerate slots和PKCS11_get_private_key returned NULL：

λ ~/pki/scripts/ openssl x509 -engine pkcs11 -CAkeyform engine -CAkey slot_0-id_2 -sha384 -CA ~/pki/paul/ca.crt -req -passin pass:$pin -in ~/pki/paul/reqs/paul.csiki.req -extfile x509-types/client -days 365 -out ~/pki/paul/issued/paul.csiki.crt
Engine "pkcs11" set.
Certificate request self-signature ok
subject=CN = paul.csiki
Failed to enumerate slots
PKCS11_get_private_key returned NULL
Could not read CA private key from org.openssl.engine:pkcs11:slot_0-id_2
409754AB157F0000:error:40000067:pkcs11 engine:ERR_ENG_error:invalid parameter:eng_back.c:603:
409754AB157F0000:error:13000080:engine routines:ENGINE_load_private_key:failed loading private key:crypto/engine/eng_pkey.c:79:

当前软件版本 #

opensc 0.23.0-1
openssl 3.0.9-1

pkcs11-tool可正常识别YubiKey中的密钥与证书 #

λ ~/ pkcs11-tool --module /usr/lib/opensc-pkcs11.so --login -O
Using slot 0 with a present token (0x0)
Logging in to "Alexandru Paul Csiki CA 2022".
Please enter User PIN:
Private Key Object; RSA
  label:      SIGN key
  ID:         02
  Usage:      sign
  Access:     always authenticate, sensitive, always sensitive, never extractable, local
Public Key Object; RSA 2048 bits
  label:      SIGN pubkey
  ID:         02
  Usage:      verify
  Access:     none
Certificate Object; type = X.509 cert
  label:      Certificate for Digital Signature
  subject:    DN: CN=Alexandru Paul Csiki CA 2022
  serial:     D9A92431209229505AAFE58D45432A67
  ID:         02

pkcs15-tool识别结果：

λ ~/ pkcs15-tool -D
Using reader with a card: Yubico YubiKey OTP+FIDO+CCID 00 00
PKCS#15 Card [Alexandru Paul Csiki CA 2022]:
    Version        : 0
    Serial number  : 00000000
    Manufacturer ID: piv_II
    Flags          :

Private RSA Key [SIGN key]
    Object Flags   : [0x01], private
    Usage          : [0x04], sign
    Access Flags   : [0x1D], sensitive, alwaysSensitive, neverExtract, local
    Algo_refs      : 0
    ModLength      : 2048
    Key ref        : 156 (0x9C)
    Native         : yes
    Auth ID        : 01
    ID             : 02

Public RSA Key [SIGN pubkey]
    Object Flags   : [0x00]
    Usage          : [0xC0], verify, verifyRecover
    Access Flags   : [0x02], extract
    ModLength      : 2048
    Key ref        : 156 (0x9C)
    Native         : yes
    ID             : 02
    DirectValue    : <absent>

X.509 Certificate [Certificate for Digital Signature]
    Object Flags   : [0x00]
    Authority      : no
    Path           :
    ID             : 02
    Encoded serial : 02 11 00D9A92431209229505AAFE58D45432A67

内容的提问来源于stack exchange，提问作者Paul