Could not sign a PDF using pkcs11 lib for BirdID cloud based digital certificate

[mcesar]

Libs: http://repo.birdid.com.br/#tokenvirtual/

Environment (please complete the following information):

• OS: macOS
• Version 13.0.1

[MatthiasValvekens]

That exception is an error from python-pkcs11, which in turn is the result of mapping the PKCS#11 CKR_SESSION_HANDLE_INVALID error code to a Python exception. In other words, the error is coming from within your PKCS#11 module, not pyHanko. In particular, it's going to be hard for other people to reproduce/troubleshoot this.

I suspect that either the PKCS#11 module itself is buggy, or interacts with python-pkcs11 in a strange way.
Were you able to produce signatures (PDF or otherwise) using this PKCS#11 module with other tooling?

[mcesar]

I can produce signatures with Adobe Acrobat Reader. The p11tool works properly too. For example: $ p11tool --provider ~/vault-pkcs11-arm.dylib --list-keys --login

[MatthiasValvekens]

Hi @mcesar,

I'm not that surprised that it works in Acrobat; commercially available PCKS#11 modules for the end-user market are typically only consistently tested with Acrobat, so... ;) The p11tool invocation you showed only lists keys, it doesn't actually try to produce a signature.

Can you run either or both of the following tests?

• Try signing a document with another PDF viewer, e.g. Foxit's (I don't know offhand if that one comes with PKCS#11 support built in, but it probably does).
• Try to use python-pkcs11 in the python interpreter to manually log in to the token and sign the string b"Hello world!".

Sorry I can't be of more help, but this type of vendor-specific issue is very difficult (if not impossible) to diagnose in the abstract.