Sectigo SafeNet Authentication Client

[JohnBoyB]

Hello, first of all, thank you very much for developing and maintaining this tool.

We have ordered a certificate from Sectigo and received it on a PKCS11 SafeNet USB token. Sectico itself provides a password but no pin. I have set it with the settings
user-pin: None
prompt-pin: False
Unfortunately I always get the message incorrect pin. I have also tried the DEFER & Skip setting, unfortunately without success.
Do you have any ideas on how I can use your tool with the password that I enter in the SafeNet Authetication client?

[JohnBoyB]

Okay, I can see that probably nobody has similar problems with sectico.
Can anyone tell me about providers where it has worked with a USB stick and PKCS11?

[aunterste]

Not yet an issue as we are looking to order a certificate, so adding to this to hear which providers worked.

[MatthiasValvekens]

Perhaps a silly suggestion, but did you try supplying the password as the PIN? There's no requirement in the PKCS11 spec that the PIN be a number... :)

[JohnBoyB]

Yes I tested it but it didn’t worked.

[MatthiasValvekens]

Did you receive any documentation about the PKCS#11 module from the vendor? PKCS#11 is an interface standard, not a hardware specification. In other words, if they're calling this a "PKCS#11 token", what they're actually saying is that they have middleware supporting the PKCS#11 standard API to communicate with the device. If their module doesn't actually implement that specification, you should take it up with them ;).

By the way, which OS are you running this on? If it's Linux: are you sure the issue is not pinentry-related? Some PKCS#11 modules are particular about the medium used to enter the PIN/password. Those typically don't accept a PIN supplied through the PKCS#11 API, but will try to spawn their own dialog through pinentry. The defaults are especially likely to cause issues if you're running in a headless environment without a GUI. If this description matches your issue, take a look at the docs for pinentry to figure out a configuration that works for you.