2

I need to sign XML document using JSR 105 api. I have already figured out, how to do it using standard provider, but now I need my code to support HSM. And this is problem.

If I initialize signing like this:

 XMLSignatureFactory fac;
 fac = XMLSignatureFactory.getInstance("DOM");

and if I use private key obtained through HSM (SunPKCS11 provider), I receive this exception / error:

my.exception.InternalServerErrorException: Internal server
error: Create signature problem
Caused by: javax.xml.crypto.dsig.XMLSignatureException: 
java.security.InvalidKeyException: No installed provider supports this key: sun.security.pkcs11.P11Key$P11PrivateKey
at
org.apache.jcp.xml.dsig.internal.dom.DOMXMLSignature.sign(DOMXMLSignature.java:411) ~[xmlsec-1.5.7.jar:1.5.7]

If I initialize signature factory with SunPkcs11 provider, this way:

XMLSignatureFactory fac;
fac = XMLSignatureFactory.getInstance("DOM", provider);

I'm getting this exception:

Caused by: javax.xml.crypto.NoSuchMechanismException: java.security.NoSuchAlgorithmException: no such algorithm: DOM for provider SunPKCS11-SunPKCS11

I googled a bit and found, that provider used in XML signing must have JSR 105 extension, but SunPkcs11 seems it doesn't have one. If it had one, it would work.

Does anybody know, how to solve this situation using opensource or Java / Oracle provided code?

Thank you, Josef

Josef Bureš
  • 125
  • 1
  • 11
  • you might want to add which HSM vendor and model you're using as they are all pretty different. – Augusto Oct 11 '15 at 15:20
  • HSM should be Thales nCipher but I don't think this is going to be that much different for other HSM's. Though difference may be in fact, that other HSMs may include own implementation of Java JSR105 provider. – Josef Bureš Oct 11 '15 at 15:47
  • I struggled a lot and found finally out that that Apache Sanctuario works fine with PKCS11 provider. Now I have last problem regarding this problem / using all this stuff in Spring application. This seems to be still mystery. – Josef Bureš Oct 15 '15 at 13:59

0 Answers0