Hello,
For a little while, I often see these kind of messages in knot:
oct. 18 06:49:12 arrakeen knotd[1636735]: error: [geekwu.org.] DNSSEC, failed to initialize signing context (PKCS #11 token not available)
When this happens, signature stops, and I only get notified by my monitoring when they're expired :/
Restarting knot is sufficent to get signing running again - no intervention needed on the HSM, the pkcs interface or anything like that.
Do you have an idea of what could happening? How to debug this? (I surely can monitor logs for this message, but it's kind of a pain)
Best regards,
BTW, here's my HSM:
# sudo -u knot pkcs11-tool --module /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --list-slots
Available slots:
Slot 0 (0x0): Nitrokey Nitrokey HSM (DENK01067960000 ) 00 00
token label : knot
token model : PKCS#15 emulated
token flags : login required, rng, token initialized, PIN initialized
hardware version : 24.13
firmware version : 3.4
serial num : DENK0106796
pin min/max : 6/15