after 8 hours of debugging, I successfully narrowed down the YubiKey PIV PKCS#11 libp11 openssl provider issue stopping openssl from finding the correct private key: The yubikey is (incorrectly) returning an X.509 attestation certificate without a public key entry if invoked via the libp11 openssl provider, but one with a public key (correctly) if invoked via p11-kit.
unfortunately i have zero clue how to continue debugging from here.
(using Nix/NixOS)
put the following into a file called `openssl.cnf`:
```
[openssl_init]
providers = provider_sect
[provider_sect]
pkcs11 = pkcs11_sect
default = default_sect
[default_sect]
activate = 1
[pkcs11_sect]
identity = pkcs11prov
module = pkcs11prov.so
debug_level = 7
pin = 123456
activate = 1
```
1/2
@jadyn yep, see openssl(1), section "Pass Phrase Arguments":
https://linux.die.net/man/1/openssl
e.g. `-passin file:/var/lib/secrets/yubikey-pin`
set the following env vars:
```
export OPENSSL_CONF=openssl.cnf
export OPENSSL_MODULES=${pkgs.libp11}/lib/ossl-module
export PKCS11_MODULE_PATH=${pkgs.yubico-piv-tool}/lib/libykcs11.so
```
look up the private key label of your PIV slot at https://docs.yubico.com/software/yubikey/tools/pivtool/piv-tool-ykcs11.html#key-alias-per-slot-and-object-type
for instance "Private key for Digital Signature" for slot 9c
2/3
@jadyn then, e.g. run:
```
$ openssl pkeyutl -provider default -provider pkcs11prov -sign -inkey "pkcs11:object=Private%20key%20for%20Digital%20Signature" -in test -out test.sig
```
3/3
pentane 🇺🇦
Jadyn - 🖨️ empress - ☎ 7889
Sophia