19 Říj
2026
19 Říj
'26
8:46
Hi Bastien,
there could be something wrong going on in the HSM. It should be
possible to set a log file and a logging level in the OpenSC
configuration, see
https://htmlpreview.github.io/?https://github.com/OpenSC/OpenSC/blob/master…
Look at the current OpenSC logs for any traces of the failures and raise
the log level in opensc.conf, if necessary. Unfortunatelly, Knot can't
provide more information about what actually failed on the HSM side.
Regards,
David
On 2026-10-19 07:52, Bastien Durel wrote:
Hello,
For a little while, I often see these kind of messages in knot:
oct. 18 06:49:12 arrakeen knotd[1636735]: error: [geekwu.org.] DNSSEC,
failed to initialize signing context (PKCS #11 token not available)
When this happens, signature stops, and I only get notified by my
monitoring when they're expired :/
Restarting knot is sufficent to get signing running again - no
intervention needed on the HSM, the pkcs interface or anything like
that.
Do you have an idea of what could happening? How to debug this? (I
surely can monitor logs for this message, but it's kind of a pain)
Best regards,
BTW, here's my HSM:
# sudo -u knot pkcs11-tool --module
/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so --list-slots
Available slots:
Slot 0 (0x0): Nitrokey Nitrokey HSM (DENK01067960000 ) 00 00
token label : knot
token manufacturer : www.CardContact.de [1]
token model : PKCS#15 emulated
token flags : login required, rng, token initialized, PIN
initialized
hardware version : 24.13
firmware version : 3.4
serial num : DENK0106796
pin min/max : 6/15
uri :
pkcs11:model=PKCS%2315%20emulated;manufacturer=www.CardContact.de;serial=DENK0106796;token=knot
[2]
Links:
------
[1] http://www.CardContact.de
[2] http://www.CardContact.de;serial=DENK0106796;token=knot
--