openCryptoki FAQ - Kent Yoder <yoder1@us.ibm.com>

-----------------------------------------------------------------------------

 1. Q. All openCryptoki applications are returning CKR_TOKEN_NOT_PRESENT,

    even though the token is there, and its STDLL is in the right place.

    What's the problem?

    A1. The user who's executing the application is probably not a member

    of the pkcs11 group.

    A2. Check that the device driver for your hardware token is loaded.

    (`lsmod` in Linux).

    A3. If you're doing development, this error will also be returned of your

    token's STDLL has unresolved symbols in it.  Enable debugging and

    check the debug log to find out what symbols are undefined.

 2. Q. When C_Initialize() gets called by my app, openCryptoki returns

    CKR_HOST_MEMORY, even though I've got lots of free memory.  What's

    the problem?

    A1. CKR_HOST_MEMORY is returned also if openCryptoki cannot attach

    to shared memory.  This can happen if:

	a1. The user who's executing the application is not a member of

	the pkcs11 group.

	a2. pkcsslotd is not running.

 3. Q. pkcsconf is returning:

    Error getting token info: 0x2

	This is CKR_HOST_MEMORY, see question 2.

    Error getting token info: 0x3

	The slot ID you're providing is invalid.

 4. Q. How can I get the complete debug logs from openCryptoki?

    A. In opencryptoki version 3.3, tracing was introduced. There is no

       longer a need to compile opencryptoki with debug enabled via

       "configure --enable-debug" to debug problems. Trace messages are

       enabled via the environment variable, OPENCRYPTOKI_TRACE_LEVEL=<level>.

       Set this environment variable to one of several trace levels available:

	1 - log error messages

	2 - log warning messages

	3 - log informational messages

	4 - log development debug messages; these messages may help debug

	    while developing pkcs#11 applications.

	5 - debug messages that are useful to opencryptoki developers;

	    this level must be enabled via --enable-debug option in the

	    configure script.

	Note: Trace messages increase as the trace level increases.

	In other words, trace level 4 includes all the messages from 

	trace levels 1, 2 and 3. 

	An additional level 5 is included for those implementing new

	features into opencryptoki source code. This level 5 allows for more

	debug output. Level 5 is enabled when compiling opencryptoki

	source code using "configure --enable-debug" and exporting

	OPENCRYPTOKI_TRACE_LEVEL=5.

       All trace output is logged into trace.<pid> file in the

       /var/log/opencryptoki directory. A trace file is created per

       process.

       Prior to opencryptoki version 3.3, opencryptoki had to be compiled

       with debugging enabled, i.e configure --enable-debug. Debug messages

       were then logged to the file specified with the 

       OPENCRYPTOKI_DEBUG_FILE environment variable. If the environment

       variable was not set, then opencryptoki debug messages were not logged.

       Debugging does not have to be enabled for syslog messages to be

       logged.  Syslog messages are logged according to the system's syslog

       configuration.

       For versions of openCryptoki starting with openCryptoki-2.0 and before

       openCryptoki-2.4, define the environment variable PKCS11_API_LOG_DEBUG=1

       (in versions of openCryptoki before 2.0, define

       AIX_PKCS11_API_LOG_DEBUG=1).

       Also, apparently by default syslogd does not have an entry in

       /etc/syslogd.conf for debug messages, so even if you have debug

       messages enabled in your openCryptoki compile, you'll not get them in

       the system log until you edit /etc/syslogd.conf and restart syslogd.

       Add an entry in /etc/syslogd.conf such as:

	# vi /etc/syslogd.conf

	---

	[...]

	*.debug				/var/log/debuglog

	---

	# killall -HUP syslogd

        Now, when openCryptoki is configured with the --enable-debug

        option (or if you install the -debug rpms), /var/log/debuglog

        will receive its debugging messages.

-----------------------------------------------------------------------------

 openCryptoki FAQ