CLI signing produces ConfigurationError: Error while loading key material

[lombaardcj007]

Note: Asked over on SO a few days ago, but then I noticed the discussions page here.

When I try to sign a PDF document from the CLI using pyhanko-cli package I get the following error:

This is the command I try to run: pyhanko sign addsig --field Sig1 pemder --key example2.key --cert example2.crt source/SCRIPT_unsigned.pdf out/SCRIPT_signed_cli.pdf

This is the output:

Key passphrase: 
2022-09-22 14:56:36,559 - pyhanko.sign.signers.pdf_cms - ERROR - Could not load cryptographic material
Traceback (most recent call last):
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/bin/pyhanko", line 8, in <module>
    sys.exit(launch())
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/pyhanko/__main__.py", line 7, in launch
    cli(prog_name='pyhanko')
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/click/decorators.py", line 26, in new_func
    return f(get_current_context(), *args, **kwargs)
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/pyhanko/cli.py", line 958, in addsig_pemder
    signer = pemder_config.instantiate(provided_key_passphrase=passphrase)
  File "/home/chris/codetest/pdfsign/pyhanko/.venv/lib/python3.9/site-packages/pyhanko/config.py", line 369, in instantiate
    raise ConfigurationError("Error while loading key material")
pyhanko.pdf_utils.config_utils.ConfigurationError: Error while loading key material

[lombaardcj007]

Sorry, I found the answer by adding the --no-pass option from this discussion. Thank you!

It's not shown on the general usage information when running pyhanko sign addsig if it can be added please.

[MatthiasValvekens]

Hmm, the information is there, but not part of the pyhanko sign addsig documentation because addsig is more general than that (it can also use PKCS#11 tokens to sign, for example, and there the --no-pass option doesn't really make sense). It is part of the pyhanko sign addsig pemder --help documentation, FWIW. I'll update the example in the docs as well.

Granted, I totally agree that that's a needlessly scary error message for a pretty mundane error condition. The situation should've improved a little with a75baef (which is part of 0.14.0), though. Are you on the latest release?