Bug 1272128

Jakub,

I am trying to install softhsm on a RHEL 7.4 Server (referring to https://wiki.opendnssec.org/display/SoftHSMDOCS/SoftHSM+Documentation+v2) and I see the following,

[root@ibm-x3650m4-01-vm-10 SoftHSMv2]# ./configure 
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... gawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
configure: sysconfdir set to /etc
configure: localstate set to /var
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for style of include used by make... GNU
checking dependency style of gcc... gcc3
checking for g++... g++
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking dependency style of g++... gcc3
checking whether g++ supports C++11 features by default... no
checking whether g++ supports C++11 features with -std=c++11... yes
checking for dlopen... no
checking for dlopen in -ldl... yes
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking pthread.h usability... yes
checking pthread.h presence... yes
checking for pthread.h... yes
checking for ECC support... yes
checking for GOST support... yes
checking for FIPS 140-2 mode... no
checking for crypto backend... OpenSSL
checking what are the OpenSSL includes... -I/usr/local/include
checking what are the OpenSSL libs... -L/usr/local/lib -lcrypto
checking openssl/ssl.h usability... no
checking openssl/ssl.h presence... no
checking for openssl/ssl.h... no
configure: error: Can't find OpenSSL headers

Could you tell me what I am missing?

You can install the already built package softhsm:

https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=500554

I am not sure in which channel it is, but there should be no need to install it from source.

Anyway, the problem you are facing looks like you did not install openssl-devel package. You will also need some other -devel dependencies as you can see from the spec file (BuildRequires):

http://pkgs.devel.redhat.com/cgit/rpms/softhsm/tree/softhsm.spec?h=rhel-7.4

How to set up softhsm:

SOPIN="12345678"
PIN="123456"
P11LIB="/usr/lib64/pkcs11/libsofthsm2.so"
echo "directories.tokendir = .tokens/" > .softhsm2.conf
mkdir ".tokens"
export SOFTHSM2_CONF=".softhsm2.conf"

# Init token
softhsm2-util --init-token --slot 0 --label "SC test" --so-pin="$SOPIN" --pin="$PIN"

# generate key & certificate
TYPE="rsa:1024"
ID="02"
LABEL="label"
pkcs11-tool --keypairgen --key-type="$TYPE" --login --pin=$PIN \
  --module="$P11LIB" --label="$LABEL" --id=$ID

# Generate certificate
certtool --generate-self-signed --outfile="$TYPE.cert" --template=cert.cfg \
  --provider="$P11LIB" --load-privkey "pkcs11:object=$LABEL;$TYPE_KEY=private" \
  --load-pubkey "pkcs11:object=$LABEL;$TYPE_KEY=public"
# convert to DER:
openssl x509 -inform PEM -outform DER -in "$TYPE.cert" -out "$TYPE.cert.der"

# write to the softhsm
pkcs11-tool --write-object "$TYPE.cert.der" --type=cert --id=$ID \
--label="$LABEL" --module="$P11LIB" --pin=$PIN

# list the objects
pkcs11-tool --module="$P11LIB" -O

# make sure the certificate is visible in the list (should not be with old version)

And I obviously missed the

  TYPE_KEY="type"

so either define this variable or use

  certtool --generate-self-signed --outfile="$TYPE.cert" --template=cert.cfg \
    --provider="$P11LIB" --load-privkey "pkcs11:object=$LABEL;$TYPE_KEY=private" \
    --load-pubkey "pkcs11:object=$LABEL;type=public"

[root@dhcp129-112 ~]# rpm -qi opensc
Name        : opensc
Version     : 0.16.0
Release     : 4.20170227git777e2a3.el7
Architecture: x86_64
Install Date: Wed 10 May 2017 11:03:34 AM EDT
Group       : System Environment/Libraries
Size        : 3256689
License     : LGPLv2+
Signature   : RSA/SHA256, Thu 13 Apr 2017 04:32:48 AM EDT, Key ID 199e2f91fd431d51
Source RPM  : opensc-0.16.0-4.20170227git777e2a3.el7.src.rpm
Build Date  : Thu 13 Apr 2017 04:04:15 AM EDT
Build Host  : x86-017.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : https://github.com/OpenSC/OpenSC/wiki
Summary     : Smart card library and applications

Softhsm was installed from brew and the attached scripted was executed succesfully.

Created attachment 1277646 [details]
list certs on softhsm

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1989