PKCS11CryptoToken

ATTRIBUTES 

(Optional) Specifies the PKCS#11 attributes used for key generation specified directly in the property value.

You cannot specify this property if ATTRIBUTESFILE is specified.

Sample p11attributes.cfg:

attributes(generate,CKO_PUBLIC_KEY,*) = {
CKA_TOKEN = false
CKA_ENCRYPT = true
CKA_VERIFY = true
CKA_WRAP = true
}
attributes(generate, CKO_PRIVATE_KEY,*) = {
CKA_TOKEN = true
CKA_PRIVATE = true
CKA_SENSITIVE = true
CKA_EXTRACTABLE = false
CKA_DECRYPT = true
CKA_SIGN = true
CKA_UNWRAP = true
}

 The PKCS#11 attributes configuration is global per shared library. If specified in multiple workers, only the configuration from the first worker loaded will be used. Changing the property might not take effect without restarting the application server.

For a Thales nCipher 'module protected' slot (slot index 0), CKA_PRIVATE must be false for the CKO_PRIVATEKEY to allow the key to be used without a login. Otherwise, the key generation will fail with a CKR_USER_NOT_LOGGED_IN PKCS#11 error.

ATTRIBUTESFILE 

(Optional) Specifies the path to file with PKCS#11 attributes used for key generation.

You cannot specify this property if ATTRIBUTES is specified.

CACHE_PRIVATEKEY

If set to true, the private key and certificate is cached in the worker so that they are not queried for each signature. This could potentially improve performance in some environments, typically where network HSMs or HSM slots with many keys are used.

Default: True.

This worker property is to be specified in the worker where the key to be used is specified by the DEFAULTKEY property. It is that key that will be cached locally in the worker. It is important to remember this if the crypto token is configured in a separate worker in which case this property should be specified in the worker that will be using the crypto token and not necessarily in the one having the crypto token configuration.

When enabled, the signer certificate is also cached if taken from the token and not overridden by specifying it in the configuration. This means that if the certificate in the token is changed, the old certificate will still be used until the worker is reloaded, clearing the cache.

This property is needed in the signer when using a OneTimeCryptoWorker.

DEFAULTKEY

Specifies the key alias of the private key to be used for testing that this crypto token is working.

If this key does not exist, the crypto token/worker will show as OFFLINE even if it has been activated. This is typically the case when the crypto token has been set up for the first time and the key has not yet been generated. To resolve, generate a key with the key alias name.

A property with this name is typically also accepted by the worker using this crypto token and will then be the key to use for actual signing.

NEXTCERTSIGNKEY

(Optional) Specifies a property with this name is typically configured in the worker using this crypto token to hold the name of the next key to use.  Certificate signing requests (CSR) can be made for this key while the current key (DEFAULTKEY) is still in production. After uploading the new certificate, the value of NEXTCERTSIGNKEY can be moved to DEFAULTKEY.

PIN

Specifies the authentication code for activation. Only required for auth-activation, otherwise the activatecryptotoken CLI command can be used.

SHAREDLIBRARY 

 This property is deprecated.

Specifies the full path to the library containing the PKCS11 interface. From version 3.7.0, this must point to a file declared in signserver_deploy.properties (or using the built-in values). If this property is defined at the same time as SHAREDLIBRARYNAME, they must point to the same library on the file system.

SHAREDLIBRARYNAME

Specifies the name of pre-defined PKCS11 library to be used. The available libraries can be configured in signserver_deploy.properties. If the legacy SHAREDLIBRARY property is also defined, it must point to the same library on the file system. This property is required, unless the old SHAREDLIBRARY is set.

SLOT or SLOTLISTINDEX

Specifies the legacy properties for indicating which slot to use. Only available for backwards compatibility. Instead use the SLOTLABELTYPE and SLOTLABELVALUE properties.

SLOTLABELTYPE 

Indicates how the slot should be identified. Supported values are SLOT_NUMBER, SLOT_INDEX, or SLOT_LABEL. Required.

SLOTLABELVALUE 

Specifies the slot to use, identified with the type specified in SLOTLABELTYPE:

• SLOT_NUMBER is the number (ID) of the slot

• SLOT_INDEX is the zero-base index of the slot in the list of available slots as returned by the PKCS#11 provider

• SLOT_LABEL this is the label of the slot

Required but not allowed if the legacy properties SLOT or SLOTLISTINDEX are specified.