Re: pkinit/opensc/soft-pkcs11

[Matthew Andrews <matt@slackers.net>]

Love Hörnquist Åstrand wrote:

>"Matthew N. Andrews" <matt@slackers.net> writes:
>
>  
>
>>I get the following error:
>>kinit: krb5_get_init_creds: Can't decrypt key: error:2A008404:PKCS11
>>library:PKCS11_rsa_decrypt:Not supported
>>    
>>
>
>Isn't this because its not supported in the opensc pkcs11 engine ?
>
>Try using DH instead (kinit --pkinit-use-dh), that will only work with
>current Heimdal.
>
>Love
>
>  
>
Yes, I believe that the "Not Supported" error is orriginating in 
soft-pkcs11. I was just trying to figure out how you would succesfully 
use soft-pkcs11 with kinit if this was the case. is there a way to get 
openssl to use the engine only for certain operations?

thanks for the note aout --pkinit-use-dh, I'll try that out for now.

-Matt Andrews