DNSSEC PKCS #11 token not available

knot version: knot-3.3.4

I use softsm as the encryptor, but the knot often has the following error message. Don't know why? Running the pkcs11 command manually is norm

knot.conf

` keystore:

• id: "softhsm" backend: pkcs11 config: "pkcs11:token=xxxxxx;pin-value=xxxxxxx /home/gtld/softhsm/lib/softhsm/libsofthsm2.so" `

error in knot.log

2024-10-11T22:46:24+0800 error: [testds.] DNSSEC, failed to initialize signing context (PKCS #11 token not available) 2024-10-11T22:46:24+0800 error: [testds.] refresh, failed (PKCS #11 token not available), next retry at 2024-10-11T22:48:24+0800 2024-10-11T22:46:24+0800 error: [testds.] zone event 'refresh' failed (PKCS #11 token not available)

error in /var/log/message

Oct 11 22:46:24 DNSSEC-KNOT-164 knot[1289]: Token.cpp(482): Could not get the token flags

changed the description

Hello! This must be a SoftHSM issue. Try to check that the token is accessible (via its full path) by the user under which knotd is running.

Btw, does it occur regularly since you reported similar issue about a year ago? #898 (comment 289755)

I am sure I have enough permissions, there are many zones in knot, not all of them have problems, but I have encountered this error occasionally recently.

All I can think of is that I recently started another knotd instance on this server that uses a different softhsm on the machine, in a different path. Does it matte

I deployed two knotd instances using softhsm on separate servers, and they have been up and running for 20 days without the previous error. But I don't see why it matters.

closed

I suspect there is some incompatibility between various softhsm versions.