Need help in configuring EJBCA on Utamaco HSM

[deepak4kb]

Hi Team,

i am getting the below error when configuring the EJBCA on Utimaco HSM

ant runinstall
Buildfile: /home/ejbca/ejbca/build.xml

customejbca.message:
[echo] No custom changes to merge.

appserver.error.message:

runinstall:

check:bootstrapdone:

ejbca:prompt:
[input] skipping input as property ca.name has already been set.
[input] skipping input as property ca.dn has already been set.
[input] skipping input as property ca.keytype has already been set.
[input] skipping input as property ca.keyspec has already been set.
[input] skipping input as property ca.signaturealgorithm has already been set.
[input] skipping input as property ca.validity has already been set.
[input] skipping input as property ca.policy has already been set.
[echo] To set httpsserver.hostname you need to configure conf/web.properties. See sample config file conf/web.properties.sample.
[input] skipping input as property httpsserver.hostname has already been set.
[echo]
[echo] Common Name (CN) of httpsserver dn is by default taken from the httpsserver.hostname.
[input] skipping input as property httpsserver.dn has already been set.
[input] skipping input as property superadmin.cn has already been set.
[input] skipping input as property superadmin.dn has already been set.
[input] skipping input as property superadmin.batch has already been set.
[input] skipping input as property superadmin.password has already been set.
[input] skipping input as property ca.tokenpassword has already been set.

ejbca:deploytrustprompt:
[input] skipping input as property java.trustpassword has already been set.

ejbca:deployprompt:
[input] skipping input as property httpsserver.password has already been set.

ejbca:init:
[echo]
[echo] ------------------- CA Properties ----------------
[echo] ca.name : ManagementCA
[echo] ca.dn : CN=MgmtCA,O=IDSignCA,C=IN
[echo] ca.tokentype : org.cesecore.keys.token.PKCS11CryptoToken
[echo] ca.keytype : RSA
[echo] ca.keyspec : 2048
[echo] ca.signaturealgorithm : SHA256WithRSA
[echo] ca.validity : 3650
[echo] ca.policy : 2.5.29.32.0
[echo] ca.tokenproperties : /home/ejbca/ejbca/conf/catoken.properties
[echo] httpsserver.hostname : idslocalhsm01
[echo] httpsserver.dn : CN=idslocalhsm01,O=IDSignCA,C=IN
[echo] superadmin.cn : SuperAdminTestCA35
[echo] superadmin.dn : CN=SuperAdminTestCA35
[echo] superadmin.batch : true
[echo] appserver.home : /home/ejbca/wildfly
[echo]

ejbca:install:

ejbca:initCA:
[echo] Initializing CA with 'ManagementCA' 'CN=MgmtCA,O=IDSignCA,C=IN' 'org.cesecore.keys.token.PKCS11CryptoToken' '<ca.tokenpassword hidden>' '2048' 'RSA' '3650' '2.5.29.32.0' 'SHA256WithRSA' --tokenprop "/home/ejbca/ejbca/conf/catoken.properties" -superadmincn 'SuperAdminTestCA35'...
[java] Initializing CA
[java] Generating rootCA keystore:
[java] CA Type:x509
[java] CA name: ManagementCA
[java] SuperAdmin CN: SuperAdminTestCA35
[java] DN: CN=MgmtCA,O=IDSignCA,C=IN
[java] CA token type: org.cesecore.keys.token.PKCS11CryptoToken
[java] CA token password: hidden
[java] Keytype: RSA
[java] Keyspec: 2048
[java] Validity: 3650d
[java] Policy ID: 2.5.29.32.0
[java] Signature alg: SHA256WithRSA
[java] Certificate profile: ROOTCA
[java] CA token properties: {slotLabelType=SLOT_NUMBER, sharedLibrary=/tmp/libcs_pkcs11_R3.so, pin=12345678, certSignKey=signKey, defaultKey=defaultKey, slotLabelValue=0, crlSignKey=signKey, testKey=testKey}
[java] Signed by: Self signed
[java] Initalizing authorization module with caid=-1047251700 and superadmin CN 'SuperAdminTestCA35'.
[java] Crypto token was unavailable: Error when creating Crypto Token with ID 588127379.

BUILD FAILED
/home/ejbca/ejbca/build.xml:75: The following error occurred while executing this line:
/home/ejbca/ejbca/bin/cli.xml:97: The following error occurred while executing this line:
/home/ejbca/ejbca/bin/cli.xml:114: The following error occurred while executing this line:
/home/ejbca/ejbca/bin/cli.xml:496: Java returned: 1

[primetomas]

You probably have some issue connecting with the HSM. You need to look in the server log to see what the issue it.
I recommend using "clientToolBox PKCS11HSMKeyTool test" first to verify that the connection to the HSM works as expected and that your keys are there.
https://doc.primekey.com/ejbca/troubleshooting-guide