# Se050 fails to list objects when OpenSSL configuration is changed **URL:** https://hub.mender.io/t/se050-fails-to-list-objects-when-openssl-configuration-is-changed/7064 **Category:** General Discussions **Created:** [August 1, 2024, 1:25pm UTC](https://hub.mender.io/t/se050-fails-to-list-objects-when-openssl-configuration-is-changed/7064 "2024-08-01T13:25:57Z") **Posts on this page:** 1 **Page:** 1
### Author: ![adamstepniak41](https://avatars.discourse-cdn.com/v4/letter/a/b38774/32.png) [@adamstepniak41](https://hub.mender.io/u/adamstepniak41) #### Post date: [August 1, 2024, 1:25pm UTC](https://hub.mender.io/t/se050-fails-to-list-objects-when-openssl-configuration-is-changed/7064/1 "2024-08-01T13:25:57Z")
I’m following example: [Securing IoT software deployments with Mender and NXP EdgeLock™ SE050](https://hub.mender.io/t/securing-iot-software-deployments-with-mender-and-nxp-edgelock-se050/2744) with se050x as engine provider openssl version OpenSSL 3.0.11 19 Sep 2023 (Library: OpenSSL 3.0.11 19 Sep 2023) I know I could use OpenSSL provider as I have 3.0.11 version, but I decided to use old engine approach as it is documented with Mender and assuming well tested. I start with having OpenSSL default configuration (as in Mender documentation) and generating key pair is going well: ./seTool genECC 0x7f000001 /dev/i2c-1 Failed to open GPIO export file : No such file or directory Failed to open GPIO value file : No such file or directory Failed to open unexport file : No such file or directory App :INFO :PlugAndTrust\_v04.05.01\_20240219 App :INFO :Running ./seTool App :INFO :Using PortName=‘/dev/i2c-1’ (CLI) App :WARN :Using SCP03 keys from:‘/home/root/se.txt’ (ENV=EX\_SSS\_BOOT\_SCP03\_PATH) sss :INFO :atr (Len=35) 00 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 08 01 00 00 00 00 64 00 00 0A 4A 43 4F 50 34 20 41 54 50 4F sss :INFO :Newer version of Applet Found sss :INFO :Compiled for 0x30100. Got newer 0x30600 sss :WARN :Object id 0x7F000001 exists App :INFO :ex\_sss Finished Getting reference to private key works as well: ./seTool getECCRef 0x7f000001 /tmp/0x7f000001.ref /dev/i2c-1 Failed to open GPIO export file : No such file or directory Failed to open GPIO value file : No such file or directory Failed to open unexport file : No such file or directory App :INFO :PlugAndTrust\_v04.05.01\_20240219 App :INFO :Running ./seTool App :INFO :Using PortName=‘/dev/i2c-1’ (CLI) App :WARN :Using SCP03 keys from:‘/home/root/se.txt’ (ENV=EX\_SSS\_BOOT\_SCP03\_PATH) sss :INFO :atr (Len=35) 00 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 08 01 00 00 00 00 64 00 00 0A 4A 43 4F 50 34 20 41 54 50 4F sss :INFO :Newer version of Applet Found sss :INFO :Compiled for 0x30100. Got newer 0x30600 App :WARN :Accessing file using absolute path App :INFO :ex\_sss Finished Then after switching to NXP OpenSSL configuration sign works successfully: openssl req -new -x509 -subj “/CN=Unit1” -engine e4sss -key /tmp/0x7f000001.ref -out /tmp/cert-e4sss.pem ssse-flw: EmbSe\_Init(): Entry App :INFO :If you want to over-ride the selection, use ENV=EX\_SSS\_BOOT\_SSS\_PORT or pass in command line arguments. App :WARN :Using SCP03 keys from:‘/home/root/se.txt’ (ENV=EX\_SSS\_BOOT\_SCP03\_PATH) sss :INFO :atr (Len=35) 00 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 08 01 00 00 00 00 64 00 00 0A 4A 43 4F 50 34 20 41 54 50 4F sss :INFO :Newer version of Applet Found sss :INFO :Compiled for 0x30100. Got newer 0x30600 ssse-flw: Version: 1.0.5 ssse-flw: EmbSe\_Init(): Exit Engine “e4sss” set. ssse-dbg: Using keyId=0x7F000001 ssse-dbg: shaAlgo: 771 ssse-flw: SSS based sign (keyId=0x7F000001, dgstLen=32) ssse-flw: SSS based sign called successfully (sigDERLen=72) ssse-flw: EmbSe\_ECDSA\_Do\_Sign success. ssse-flw: EmbSe\_Finish(): Entry ssse-flw: EmbSe\_Finish(): Exit ssse-flw: EmbSe\_Destroy(): Entry So far so good. Then I try to use pkcs11-tool to list available objects thought pkcs11-tool --module /home/root/simw-top/build/sss/plugin/pkcs11/libsss\_pkcs11.so -O and get following output: pkcs11-tool --module /home/root/simw-top/build/sss/plugin/pkcs11/libsss\_pkcs11.so -O Using slot 0 with a present token (0x1) smCom :WARN :Invalid conn\_ctx App :INFO :If you want to over-ride the selection, use ENV=EX\_SSS\_BOOT\_SSS\_PORT or pass in command line arguments. App :WARN :Using SCP03 keys from:‘/home/root/se.txt’ (ENV=EX\_SSS\_BOOT\_SCP03\_PATH) sss :INFO :atr (Len=35) 00 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 08 01 00 00 00 00 64 00 00 0A 4A 43 4F 50 34 20 41 54 50 4F sss :INFO :Newer version of Applet Found sss :INFO :Compiled for 0x30100. Got newer 0x30600 ssse-flw: EmbSe\_Init(): Entry App :INFO :If you want to over-ride the selection, use ENV=EX\_SSS\_BOOT\_SSS\_PORT or pass in command line arguments. App :WARN :Using SCP03 keys from:‘/home/root/se.txt’ (ENV=EX\_SSS\_BOOT\_SCP03\_PATH) sss :INFO :atr (Len=35) 00 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 08 01 00 00 00 00 64 00 00 0A 4A 43 4F 50 34 20 41 54 50 4F sss :INFO :Newer version of Applet Found sss :INFO :Compiled for 0x30100. Got newer 0x30600 ssse-flw: Version: 1.0.5 ssse-flw: EmbSe\_Init(): Exit ssse-flw: EmbSe\_Rand invoked requesting 8 random bytes smCom :ERROR:phNxpEseProto7816\_DecodeFrame Max retry count reached!!! smCom :ERROR:phNxpEseProto7816\_Transceive Transceive failed, hard reset to proceed smCom :ERROR: phNxpEse\_Transceive phNxpEseProto7816\_Transceive- Failed smCom :ERROR: Transcive Failed sss :WARN :nxEnsure:‘retStatus == SM\_OK’ failed. At Line:7975 Function:sss\_se05x\_channel\_txn sss :WARN :nxEnsure:‘ret == SM\_OK’ failed. At Line:7837 Function:sss\_se05x\_TXn scp :ERROR:GP\_InitializeUpdate Failure on communication Link FFFF scp :ERROR:nxScp03\_GP\_InitializeUpdate fails with Status 3C3C0000 sss :ERROR:Could not set SCP03 Secure Channel App :ERROR:sss\_session\_open failed PKCS11:WARN :nxEnsure:‘sss\_status == kStatus\_SSS\_Success’ failed. At Line:1002 Function:C\_OpenSession error: PKCS11 function C\_OpenSession failed: rv = CKR\_GENERAL\_ERROR (0x5) When I switch back to default OpenSSL configuration then all objects present in secure element are listed correctly. Why OpenSSL is needed at all when running pkcs11-tool through PKCS#11? What am I doing wrong?