Why lists pksc11-tool seven Objects but Java Keystore has Only one

Question

When I do in the cmd line:

pkcs11-tool --login -O

I get seven Objects that are on my smartcard, 3 Public Key Objects, 3 Certificate Objects and one Private Key Object.

But when I try to do the same with a small Java Code, I only find one Certificate:

 String pkcs11Config = "name = SmartCard\nlibrary = opensc-pkcs11.dll\nslot=0";
  ByteArrayInputStream confStream = new ByteArrayInputStream(pkcs11Config.getBytes());
  Provider prov = new sun.security.pkcs11.SunPKCS11(confStream);
  Security.addProvider(prov);
  String pin = "0000000";
  KeyStore cc = KeyStore.getInstance("PKCS11", prov);
  cc.load(null, pin.toCharArray());

  // Look for certificate
  Enumeration aliases = cc.aliases();
  for (Enumeration e = aliases; e.hasMoreElements();) {
    Object alias = aliases.nextElement();
    System.out.println("Alias is : " + alias);
  }

Why Do I found no Public key or other Certificate with this code?

score 1 · Accepted Answer · answered Dec 13 '18 at 20:07

It's standard behavior of JAVA's SunPKCS11 provider. Its implementation is usually documented in "PKCS#11 reference guide":

Pick a correct guide for your JAVA version and take a look at "KeyStore requirements" chapter. You'll find out that SunPKCS11 provider returns aliases only for pairs of certificates and their matching private keys (that's one entry in your case) and ignores all other objects.

Why lists pksc11-tool seven Objects but Java Keystore has Only one

1 Answers1