using osslsigncode with SafeNet eToken 5100 on Debian Linux (Trixie)

[gergap]

Hi,

I can't get the tool to work with this token. I used it in the past with file based keys, but with the token I have no success.
First I tried it with the PKCS11 engine for OpenSSL and OpenSC PKCS11 module.
p11tool can list the token, so PKCS11 seems to work in general with it.

Debian delivers OpenSSL3 and the legacy engine, but not the newer PKCS11 provider.

osslsigncode -v
osslsigncode 2.9, using:
        OpenSSL 3.3.2 3 Sep 2024 (Library: OpenSSL 3.5.4 30 Sep 2025)
Default -CAfile location: /etc/ssl/certs/ca-certificates.crt

Please send bug-reports to Michal.Trojnara@stunnel.org

Output:

osslsigncode sign -pkcs11engine /usr/lib/x86_64-linux-gnu/engines-3/pkcs11.so -pkcs11module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -pkcs11cert 'pkcs11:model=PKCS%2315%20emulated;manufacturer=Gemalto;serial=99...;token=Unified%20Automation%20GmbH;id=%00%01;object=Certificate%201;type=cert' -key 'pkcs11:model=PKCS%2315%20emulated;manufacturer=Gemalto;serial=99...;token=Unified%20Automation%20GmbH;id=%00%01;object=Private%20key%201;type=private' -n 'Unified Automation GmbH' -i https://www.unified-automation.com -in uaserverhp.exe -out uaserverhp-signed.exe -t http://timestamp.sectigo.com
Engine "pkcs11" set.
Enter PKCS#11 token PIN for Unified Automation GmbH:
PKCS7_dataFinal failed
Failed to sign spcIndirectDataContent
Failed to set signed content
Unable to prepare new signature
40A727C99C7F0000:error:43000005:PKCS#11 module:ERR_CKR_error:General Error:p11_rsa.c:147:
Failed

Then I compiled the PKCS11 provider from github from source, and built the lasted osslsigncode from github which gives you the new -provider option (the Debian version does not have this).

Still it does not work:

./osslsigncode/bin/osslsigncode sign -provider /usr/lib/x86_64-linux-gnu/ossl-modules/pkcs11.so -pkcs11module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -pkcs11cert 'pkcs11:model=PKCS%2315%20emulated;manufacturer=Gemalto;serial=99.....;token=Unified%20Automation%20GmbH;id=%00%01;object=Certificate%201;type=cert' -key 'pkcs11:model=PKCS%2315%20emulated;manufacturer=Gemalto;serial=99...;token=Unified%20Automation%20GmbH;id=%00%01;object=Private%20key%201;type=private' -n 'Unified Automation GmbH' -i https://www.unified-automation.com -in uaserverhp.exe -out uaserverhp-signed.exe -t http://timestamp.sectigo.com
Enter pass phrase for PKCS#11 Token (Slot 17 - SafeNet eToken 5100 [eToken 5110 SC] 00 00):
PKCS7_dataFinal failed
Failed to sign spcIndirectDataContent
Failed to set signed content
Unable to prepare new signature
4047F4C6F27F0000:error:030000EA:digital envelope routines:EVP_DigestSignFinal:provider signature failure:../crypto/evp/m_sigver.c:534:RSA digest_sign_final:PKCS11 RSA Implementation
Failed

Both variants give a similar signature error, but I don't know why this happens.
Any Ideas what is wrong and how I can it make working?

[gergap]

I was able to make it working with libeToken.so:

osslsigncode sign -h sha256 -pkcs11engine /usr/lib/x86_64-linux-gnu/engines-3/pkcs11.so -pkcs11module /usr/lib/libeToken.so -pkcs11cert 'pkcs11:model=ID%20Prime%20MD;manufacturer=Gemalto;seri...
...
Connecting to http://timestamp.sectigo.com
Succeeded

I donwnloaded it from here: https://knowledge.digicert.com/general-information/how-to-download-safenet-authentication-client
unpacked the Ubuntu2204 withOut GUI package. Just used this .so with osslsigncode. No other tool from Safenet required.