0

We are trying here to implement a java standalone application that can connect to a https website and authenticate with a PKI Smartcard and we are running through all sorts of problems.

I have to mention that we are able to run this kind of application if we use an applet (then the browser's keystore and trustore will be used), everything works perfectly fine, we enter the card pin number and we get access to the webpage.

I have two questions. First regarding my code, does someone sees something wrong with it. I include the runtime error we have while running it:

public class TestPKCS11 {

/**
 * @param args the command line arguments
 */
public static void main(String[] args) {

    // Set keyStore and trustStore
    System.setProperty("javax.net.ssl.trustStoreType", "PKCS11");
    System.setProperty("javax.net.ssl.trustStore", "NONE");
    System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
    System.setProperty("javax.net.ssl.trustStoreProvider", "SunPKCS11-mycard");
    String trustStore = System.getProperty("javax.net.ssl.trustStore");
    if (trustStore == null) {
        System.out.println("javax.net.ssl.trustStore is not defined");
    } else {
        System.out.println("javax.net.ssl.trustStore = " + trustStore);
    }

    System.setProperty("javax.net.ssl.keyStoreType", "PKCS11");
    System.setProperty("javax.net.ssl.keyStore", "NONE");
    System.setProperty("javax.net.ssl.keyStorePassword", "changeit");
    System.setProperty("javax.net.ssl.keyStoreProvider", "SunPKCS11-mycard");
    String keyStore = System.getProperty("javax.net.ssl.keyStore");
    if (keyStore == null) {
        System.out.println("javax.net.ssl.keyStore is not defined");
    } else {
        System.out.println("javax.net.ssl.keyStore = " + keyStore);
    }

    System.setProperty("javax.net.debug", "ssl"); // dynamic conf of PKCS#11

    String configName = "C:\\confDirectory\\pkcs11.cfg";

    sun.security.pkcs11.SunPKCS11 sunPKCS11 = new sun.security.pkcs11.SunPKCS11(configName);
    Provider p = sunPKCS11;
    Security.addProvider(p);


    SSLSocketFactory sslFact = (SSLSocketFactory) SSLSocketFactory.getDefault();

    try{
        SSLSocket sock = (SSLSocket)sslFact.createSocket("myserver", 8081);

        sock.startHandshake();

    } catch (SSLHandshakeException ex) {
        Logger.getLogger(TestPKCS11.class.getName()).log(Level.SEVERE, null, ex);
        System.out.println(ex.getMessage());
    } 
    catch (IOException ex) {
        Logger.getLogger(TestPKCS11.class.getName()).log(Level.SEVERE, null, ex);
    }
}

Execute ERROR:

Exception in thread "main" java.security.ProviderException: Initialization failed
    at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:340)
    at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:86)
    at TestPKCS11.main(TestPKCS11.java:95)
Caused by: java.io.IOException: The specified procedure could not be found.
    at sun.security.pkcs11.wrapper.PKCS11.connect(Native Method)
    at sun.security.pkcs11.wrapper.PKCS11.<init>(PKCS11.java:141)
    at sun.security.pkcs11.wrapper.PKCS11.getInstance(PKCS11.java:154)
    at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:281)
    ... 2 more

My second question is regarding the dll to use for pkcs11. Currently i'm using on that is included in IBM's Rational's installation (jpkcs11.dll) but i'm really not sure that it's the good one. I do read about OpenSC but can't find the OpenSC-pkcs11.dll file. I only get to see opensc.dll.

I'm running on Windows7 with Java 1.6 27

Thank you

2 Answers 2

2

OpenSC PKCS#11 is named "opensc-pkcs11.dll" and it is put to system32. But you need to make sure that your smart card is supported by OpenSC. As a general rule: you need to use the PKCS#11 provider that comes with your card (usually closed source) or supports your card (like OpenSC)

1
  • ok I don't find it system32. Maybe a security mesure from the client that doesn't allow new dll in this folder, have to verify.
    – jon
    Jan 17, 2012 at 10:06
0

Instead of putting DLL to system32, you could load it dynamically from users home directory. But it depends on your application, how you are going to install it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.