GoogleCloudPlatform / GoogleCloudPlatform/kms-integrations
PKCS#11 signing: argument pData was unexpectedly null on RHEL 9.6 with OpenSSL 3.2.2
- Dominant language
- C++
- Stars
- 47
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
On RedHat Linux 9.6 (via Docker image `registry.access.redhat.com/ubi9/ubi-minimal:9.6-1755695350` with OpenSSL 3.2.2, I see a warning message when using the PKCS#11 FIPS library to sign a binary with Google Cloud HSM:
```
I20250911 05:40:42.692146 140020334341184 logging.cc:185] returning 0x7 from C_Sign due to status INVALID_ARGUMENT: at bridge.cc:697: argument pData was unexpectedly null [type.googleapis.com/kmsp11.StatusDetails='CK_RV=0x7']
```
The binary seems to have been signed just fine, however.
This is the invocation of `osslsigncode`:
```
osslsigncode sign -h sha256 -pkcs11engine /usr/lib64/engines-3/pkcs11.so -pkcs11module /usr/local/lib/libkmsp11.so -certs chain.crt -key pkcs11:object=my-key -in work/test.exe -out work/new.exe -ts http://ts.ssl.com
```
When I downgraded to RedHat Linux 8.10 with OpenSSL 1.1, I did not see this warning.
Contributor guide
Assessment
This issue has not been assessed yet.