|  |  |  | # Frequently asked Questions (FAQs)

Here we provide answers to frequently asked questions. These may help you to solve problems quickly.

## 1. Errors

### Q1.1: Why do I always get an `java.lang.UnsatisfiedLinkError: no pkcs11wrapper in java.library.path`?

### Q1.2: What does the exception with the error code `CKR_OPERATION_NOT_INITIALIZED` mean?

### Q1.3: When running some of the samples which try to generate keys, I get an `iaik.pkcs.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID`. What is wrong?

### Q1.4: I use the PKCS#11 Wrapper from within an applet. The applet works in principle, but when a press the reload button in my browser, I get an `java.lang.UnsatisfiedLinkError: Native Library pkcs11wrapper.dll already loaded in another classloader`. What causes this problem and how can i solve it?

## 2. Strange Behavior

### Q2.1: My application uses `findObjectsInit`, `findObjects` and `findObjectsFinal` to search for certain objects and seems to get objects that do not match the template. Is that a bug of the wrapper?

### Q2.2: My application uses `findObjectsInit`, `findObjects` and `findObjectsFinal` to search for certain objects. The find operation does not return any objects, even if there are objects on the token that match the template. What is wrong?

### Q2.3: When I start a demo program to sign something, I get the response that there is no key for signing on the token. However, I know that there is a signature key on the card. The `GetInfo` demo even shows it. Is this a bug?

## 3. How Can I...

### Q3.1: How can I import my private key and certificate into the smart card?

### Q3.2: How can I export certificates from my smart card?

### Q3.3: How can I run an applet or application which is based on the wrapper with the Microsoft VM?

## 1. Errors

### Q1.1: Why do I always get an `java.lang.UnsatisfiedLinkError: no pkcs11wrapper in java.library.path`?

It seems that you do not have the pkcs11wrapper.dll (or libpkcs11wrapper.so under Unix) in you search path. You can provide such a path directly to the Java VM setting the `java.library.path` system property like:

`java -Djava.library.path=../../native/platforms/win32/Release;. -cp ../classes;../../java/classes;../../java/resources;../lib/iaik_jce_full.jar demo.pkcs.pkcs11.GetInfo cryptoki.dll`

where `../../native/platforms/win32/Release` is the path where the pkcs11wrapper.dll (or libpkcs11wrapper.so under unix) file is. You can also place the file in the folder for binary files of you Java Runtime Environment; e.g. the `jre/bin` folder. Alternatively, you can also place the file pkcs11wrapper.dll in the system directory of Windows. On Unix systems you can place the libpkcs11wrapper.so in a `lib` directory of the system.

### Q1.2: What does the exception with the error code `CKR_OPERATION_NOT_INITIALIZED` mean?

This normally means that the PKCS#11 driver you are using has a bug. We observed this bug with the drivers for iButton (version 1.01) and with older drviers for Datakey cards and iKey 2000 series tokens. For Datakey cards and iKey 2000 series tokens there are already drivers that fix this bug.
Bug details: The wrapper asks the driver for the required buffer length for returned data. It uses the method specified in the PKCS#11 standard - it passes NULL_PTR as buffer when calling the driver function (e.g. C_Sign). The driver must answer with the required buffer length, but it must not abort any active operation (e.g. signing). Thereafter, the wrapper allocates the required buffer and calls the function (e.g. C_Sign) a second time, providing the appropriate buffer. Now the driver should process the operation and finalize it if appropriate. Drivers with that bug abort the active operation after the first (query buffer length) call. According to the standard they must not do this.
If you want to do a workaround, this is possible. You have to modify the function `Java_iaik_pkcs_pkcs11_wrapper_PKCS11Implementation_C_1Sign` in the file `pkcs11wrapper.c`. Instead of asking for the required buffer length, modify the wrapper to use a buffer with a sufficient length. Have a look the source code, you will quickly see what has to be done. To anticipate the question: No, this workaround will not become part of the next release. We do not include any code which's only purpose is to workaround bugs of third-party products. Ask the vendor of the product to fix the bug.

### Q1.3: When running some of the samples which try to generate keys, I get an iaik.pkcs.pkcs11.wrapper.PKCS11Exception: CKR_ATTRIBUTE_TYPE_INVALID. What is wrong?

We had similar problems with certain cards; e.g. the Rainbow iKey2032 and DataKey cards. This is due to bugs in drivers. As workaround you can try to set the class and key-type attributes as not present. This may look like this: ``

secreteEnrcyptionKeyTemplate.getObjectClass().setPresent(false);
secreteEnrcyptionKeyTemplate.getKeyType().setPresent(false);

maybe the driver accepts the key template if you try this.

### Q1.4: I use the PKCS#11 Wrapper from within an applet. The applet works in principle, but when a press the reload button in my browser, I get an `java.lang.UnsatisfiedLinkError: Native Library pkcs11wrapper.dll already loaded in another classloader`. What causes this problem and how can i solve it?

The Java VM causes this error. SUN's Java VMs have the restriction that they cannot handle native libraries from more than one classloader. You may have a look at the bug database at SUN's Java web site and search for the bug entries with the IDs 4286309, 4642062 and 4299094. According to the comments from SUN, according to the fact that they consider this a restriction (or a feature) rather than a bug, and that this bug has been there for many years, it is unlikely that this will be fixed soon. The only workaround that we are aware of is to place the class which directly accesses the native library (i.e. `iaik.pkcs.pkcs11.wrapper.PKCS11Implementation`) or the complete jar file which contains this class (i.e. `iaikPkcs11Wrapper.jar`) into the `jre/lib/ext` directory of the Java Runtime. Note that this problem may also occur in application servers. The solution will be analogous there.
However, we have heard that there are other VMs (like Oracle) which do not contain this bug.

## 2. Strange Behavior

### Q2.1: My application uses `findObjectsInit`, `findObjects` and `findObjectsFinal` to search for certain objects and seems to get objects that do not match the template. Is that a bug of the wrapper?

No, this is not a bug of the wrapper. It is a bug of the PKCS#11 driver that you use. We found such bugs in drivers for DataKey cards and iKey 2000 series tokens.

### Q2.2: My application uses `findObjectsInit`, `findObjects` and `findObjectsFinal` to search for certain objects. The find operation does not return any objects, even if there are objects on the token that match the template. What is wrong?

It is a bug of the PKCS#11 driver that you use. We found such bugs in drivers for DataKey cards and iKey 2000 series tokens.

### Q2.3: When I start a demo program to sign something, I get the response that there is no key for signing on the token. However, I know that there is a signature key on the card. The `GetInfo` demo even shows it. Is this a bug?

Yes, it is a bug in the find operations of the PKCS#11 driver that you use. We found such bugs in drivers for DataKey cards and iKey 2000 series tokens.

## 3. How Can I...

### Q3.1: How can I import my private key and certificate into the smart card?

There is a demo included to do that. It is called `DownloadPrivateKey`. You can start it using the batch file in the `demo/test` directory.

### Q3.2: How can I export certificates from my smart card?

There is a demo included to do that. It is called `DumpObjects`. You can start it using the batch file in the `demo/test` directory. In the output directory that you specify on the command line, you can find the DER-encoded certificates. In Windows you can open them by simply double-clicking them in the file explorer.

### Q3.3: How can I run an applet or application which is based on the wrapper with the Microsoft VM?

The Microsoft Java VM is based on the JDK 1.1.5 specification and requires a native wrapper DLL which does not use callbacks. In the directory `native/platforms/win32/release_JDK11` there is such a version. You must place this DLL somewhere in the search path of your system; e.g. `C:\WINNT\System32`. In addition, it is necessary to place the wrapper's class files in the classes directory of the Java VM. This is usually in the `<Windows DIR>/java/classes`. You must place the class files unpacked; e.g. `C:/WINNT/java/classes/iaik/pkcs/pkcs11/Module.class` and so on. Your applet which is based on the PKCS#11 wrapper can be developed and deployed like any other applet. Unfortunately, there seems to be no easier way to get the wrapper running with the Microsoft VM.

Copyright (c) 2002-2003 by IAIK. Copyright (C) 2003-2004 Stiftung SIC. All rights reserved.