GoogleCloudPlatform / GoogleCloudPlatform/kms-integrations

PKCS#11 signing: argument pData was unexpectedly null on RHEL 9.6 with OpenSSL 3.2.2

Open
#54 3 comments 1 reaction 0 assignees View on GitHub
needs further investigation
Dominant language
C++
Stars
47
Forks
24
PR merge metrics
No merged PRs in 30d

Description

On RedHat Linux 9.6 (via Docker image `registry.access.redhat.com/ubi9/ubi-minimal:9.6-1755695350` with OpenSSL 3.2.2, I see a warning message when using the PKCS#11 FIPS library to sign a binary with Google Cloud HSM:

```
I20250911 05:40:42.692146 140020334341184 logging.cc:185] returning 0x7 from C_Sign due to status INVALID_ARGUMENT: at bridge.cc:697: argument pData was unexpectedly null [type.googleapis.com/kmsp11.StatusDetails='CK_RV=0x7']
```

The binary seems to have been signed just fine, however.

This is the invocation of `osslsigncode`:

```
osslsigncode sign -h sha256 -pkcs11engine /usr/lib64/engines-3/pkcs11.so -pkcs11module /usr/local/lib/libkmsp11.so -certs chain.crt -key pkcs11:object=my-key -in work/test.exe -out work/new.exe -ts http://ts.ssl.com
```

When I downgraded to RedHat Linux 8.10 with OpenSSL 1.1, I did not see this warning.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.