Entrust nShield Connect

由于密钥已就位，我们只需构建 key server 启动时会读取的配置文件。在本示例中，设备包含一对 RSA 密钥。

我们让 pkcs11-tool（由 opensc 包提供）显示 token 中存储的对象：

pkcs11-tool --module /opt/nfast/toolkits/pkcs11/libcknfast.so -O

Using slot 0 with a present token (0x1d622495)
Private Key Object; RSA
  label:      rsa-privkey
  ID:         105013281578de42ea45f5bfac46d302fb006687
  Usage:      decrypt, sign, unwrap
warning: PKCS11 function C_GetAttributeValue(ALWAYS_AUTHENTICATE) failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)

Public Key Object; RSA 2048 bits
  label:      rsa-privkey
  ID:         105013281578de42ea45f5bfac46d302fb006687
  Usage:      encrypt, verify, wrap

关键信息是对象的标签 rsa-privkey。打开 /etc/keyless/gokeyless.yaml，紧接在

private_key_stores:
  - dir: /etc/keyless/keys

之后添加

- uri: pkcs11:token=accelerator;object=rsa-privkey?module-path=/opt/nfast/toolkits/pkcs11/libcknfast.so&max-sessions=4

保存配置文件，重启 gokeyless，并验证是否成功启动。

sudo systemctl restart gokeyless.service
sudo systemctl status gokeyless.service -l