Signing document with qualified certificate - smart card

问题

Code below works correctly for 2 different cryptografic smart-card libraries (certum cryptoCertum3PKCS.dll and cencert enigmap11.dll ), but it's crashing for kir(szafir) lib - ccpkip11.dll, after providing pin, which is for 100% correct

Anyone has an idea what I'm doing wrong?

  KeyingDataProvider kp = new PKCS11KeyStoreKeyingDataProvider(
                settings.getDriverPath(),
                settings.getProviderName(),
                settings.getSlot(),
                new CertificateSelector(),
                new KeyStorePasswordProvider(), null, false); 

        Document src = getDocumentBuilder().parse(new File(filename));
        Document dest = getDocumentBuilder().newDocument();
        Node objContent = dest.importNode(src.getDocumentElement(), true);

        XadesSigner signer = new XadesBesSigningProfile(kp).newSigner();

        DataObjectDesc obj = new EnvelopedXmlObject(objContent, "text/xml", null);
        signer.sign(new SignedDataObjects(obj), dest);

        Transformer transformer = TransformerFactory.newInstance().newTransformer();
        Result output = new StreamResult(new File(signed));
        Source input = new DOMSource(dest);

        transformer.transform(input, output);

I have CKR_PIN_LEN_RANGE error at line signer.sign(new SignedDataObjects(obj), dest); full stacktrace:

 xades4j.verification.UnexpectedJCAException: The keystore couldn't be initialized
        at xades4j.providers.impl.KeyStoreKeyingDataProvider.ensureInitialized(KeyStoreKeyingDataProvider.java:179)
        at xades4j.providers.impl.KeyStoreKeyingDataProvider.getSigningCertificateChain(KeyStoreKeyingDataProvider.java:189)
        at xades4j.production.SignerBES.sign(SignerBES.java:151)
        at xades4j.production.SignerBES.sign(SignerBES.java:122)
        at com.riv.jpk.security.XadesHelper.sign(XadesHelper.java:127)
        at com.riv.jpk.RaportGenerators.BaseGen.signXml(BaseGen.java:192)
        at com.riv.jpk.ui.views.GenerateJPK.JpkGeneratorVM.signXml(JpkGeneratorVM.java:417)
        at com.riv.jpk.ui.views.GenerateJPK.JpkGeneratorVM.lambda$validateMetaXML$44(JpkGeneratorVM.java:403)
        at com.riv.jpk.ui.views.GenerateJPK.JpkGeneratorVM$$Lambda$361/32216595.handle(Unknown Source)
        at com.sun.javafx.event.CompositeEventHandler$NormalEventHandlerRecord.handleBubblingEvent(CompositeEventHandler.java:218)
        at com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(CompositeEventHandler.java:80)
        at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(EventHandlerManager.java:238)
        at com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(EventHandlerManager.java:191)
        at com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(BasicEventDispatcher.java:58)
        at com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(EventDispatchChainImpl.java:114)
        at com.sun.javafx.event.EventUtil.fireEventImpl(EventUtil.java:74)
        at com.sun.javafx.event.EventUtil.fireEvent(EventUtil.java:54)
        at javafx.event.Event.fireEvent(Event.java:198)
        at javafx.concurrent.EventHelper.fireEvent(EventHelper.java:219)
        at javafx.concurrent.Task.fireEvent(Task.java:1356)
        at javafx.concurrent.Task.setState(Task.java:723)
        at javafx.concurrent.Task$TaskCallable.lambda$call$496(Task.java:1434)
        at javafx.concurrent.Task$TaskCallable$$Lambda$347/3131345.run(Unknown Source)
        at com.sun.javafx.application.PlatformImpl.lambda$null$170(PlatformImpl.java:295)
        at com.sun.javafx.application.PlatformImpl$$Lambda$51/6271097.run(Unknown Source)
        at java.security.AccessController.doPrivileged(Native Method)
        at com.sun.javafx.application.PlatformImpl.lambda$runLater$171(PlatformImpl.java:294)
        at com.sun.javafx.application.PlatformImpl$$Lambda$49/19468568.run(Unknown Source)
        at com.sun.glass.ui.InvokeLaterDispatcher$Future.run(InvokeLaterDispatcher.java:95)
        at com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
        at com.sun.glass.ui.win.WinApplication.lambda$null$145(WinApplication.java:101)
        at com.sun.glass.ui.win.WinApplication$$Lambda$39/443957.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:745) Caused by: java.security.KeyStoreException: KeyStore instantiation failed
        at java.security.KeyStore$Builder$2.getKeyStore(KeyStore.java:1967)
        at xades4j.providers.impl.KeyStoreKeyingDataProvider.ensureInitialized(KeyStoreKeyingDataProvider.java:175)
        ... 32 more 
Caused by: java.io.IOException: load failed
        at sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:843)
        at java.security.KeyStore.load(KeyStore.java:1479)
        at java.security.KeyStore$Builder$2$1.run(KeyStore.java:1937)
        at java.security.KeyStore$Builder$2$1.run(KeyStore.java:1918)
        at java.security.AccessController.doPrivileged(Native Method)
        at java.security.KeyStore$Builder$2.getKeyStore(KeyStore.java:1964)
        ... 33 more
Caused by: javax.security.auth.login.LoginException
        at sun.security.pkcs11.SunPKCS11.login(SunPKCS11.java:1238)
        at sun.security.pkcs11.P11KeyStore.login(P11KeyStore.java:849)
        at sun.security.pkcs11.P11KeyStore.engineLoad(P11KeyStore.java:834)
        ... 38 more
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_PIN_LEN_RANGE
        at sun.security.pkcs11.wrapper.PKCS11.C_Login(Native Method)
        at sun.security.pkcs11.SunPKCS11.login(SunPKCS11.java:1222)
        ... 40 more

回答1:

I've found it! Solution was to run C_GetSlotList before creating KeyingDataProvider.

PKCS11 p11 = PKCS11.getInstance(settings.getDriverPath(), "C_GetFunctionList", null, false);
long[] slots = p11.C_GetSlotList(true);

I'm not sure what was the case. In this smart card, qualified certificate was on slot 3, and it looks like java pksc#11 implementation has a problem to get this slot before running C_GetSlotList.

来源：https://stackoverflow.com/questions/41958819/signing-document-with-qualified-certificate-smart-card