Using osslsigncode for Certum signing on Linux

[floitsch]

Hi,
I'm using osslsigncode to sign my Windows executables on a Linux machine using a Certum dongle.

In version 2.9, I was able to run the following command:

osslsigncode sign \
-pkcs11module "$pkcs11_module" \
-certs "$certificate" \
-key "$key" \
-pass "$CERT_PIN" \
-h sha256 \
-t http://time.certum.pl/ \
-in "$unsigned_exe" \
-out "$signed_exe"

where the module is manager/sc30pkcs11-3.0.6.68-MS.so, the certificate is certificate.pem, and the key is d7c78f453acfaa35791f0232f351465c6d16ab94.

However, in 2.10 (and probably? 2.11) I get the following error:

Failed to read key or certificates
C0607C378B7F0000:error:80000002:system library:file_open:No such file or directory:providers/implementations/storemgmt/file_store.c:251:calling stat(d7c78f453acfaa35791f0232f351465c6d16ab94)

It looks like osslsigncode is trying to open a file with the name of the ID.

Is there an easy way to adjust the command-line so it works with 2.10/2.11 as well?

[olszomal]

Starting with osslsigncode 2.10, both the key and certificate must be specified using valid PKCS#11 URIs.
Providing a raw key ID is no longer supported and will be treated as a file path.

Please follow the documentation available here:
Using the PKCS#11 Provider

[floitsch]

For reference (if others run into the same issue).

I had to replace -key "d7c78f453acfaa35791f0232f351465c6d16ab94 with -key "pkcs11:token=common%20profile;id=%D7%C7%8F%45%3A%CF%AA%35%79%1F%02%32%F3%51%46%5C%6D%16%AB%94;type=private