RCM installation fails with error 'Unable to load crypto provider : pkcs11v2 /usr/lunasa/lib/libCryptoki2_64.so' and '[XrcBADVALUE: invalid or inappropriate value provided]'
2 years ago
Originally Published: 2012-12-05
Article Number
000049339
Applies To
RSA Certificate Manager 6.9
Red Hat Enterprise Linux
SafeNet Luna Client 5.1
Issue
RCM installation fails with error "Unable to load crypto provider : pkcs11v2,/usr/lunasa/lib/libCryptoki2_64.so" and "[XrcBADVALUE: invalid or inappropriate value provided]"
When INSTALL script is run (to install RSA Certificate Manager 6.9), the following output is generated on the console:

[usera@hostname RSA_CM]$ ./INSTALL

Please indicate whether this is a new installation or an upgrade
of an existing installation.
  1. New Install
  2. Upgrade
Please enter your choice (1 or 2): 1

If nCipher is installed, it is automatically detected.
If you have additional cryptographic providers installed on your system,
you can select one for use with RSA Certificate Manager. Search now?
(NOTE: Skipping this step means that 3rd party
       cryptographic providers will not be used.)
  1. Yes, do the configuration
  2. No, skip the configuration
Please enter your choice (1, 2, or `<' to go back): 1

For the PKCS#11 provider library, would you like to
  1. search default directory trees
     (/lib /usr/lib /usr/local/lib)
     and optionally any other specified directories?
  2. skip the search and continue with the installation?
Please enter your choice (1, 2 or `<' to go back): 1

Enter the names of any additional directories to search
(separated by spaces or tabs), `<' to go back to the previous
menu, or just press enter for none.  You may use `.' to indicate
the current working directory:
>> /usr/lunasa/lib

Enter the name of the provider library:
>> libCryptoki2_64.so

Searching directory tree below /lib...
Searching directory tree below /usr/lib...
Searching directory tree below /usr/local/lib...
Searching directory tree below /usr/lunasa/lib...

Found the following files:
  1. /usr/lib/libCryptoki2_64.so
  2. /usr/lunasa/lib/libCryptoki2_64.so

Choose the file to use by selecting its number, `<' to
go back, or just press enter to use the first entry.
>> 2

`/usr/lunasa/lib/libCryptoki2_64.so' added

We are now ready to set up IDS (Installation Directory
Server) and IWS (Installation Web Server).
Enter `<' to go back or just press enter to
proceed to the next step.
>>

Installing on a local filesystem...

Reading configuration parameters.
    Reading configuration from file [../conf/ids.conf]

Checking network.

Confirming existence of target directories:
    /opt/RSA_CM/ids/conf
    /opt/RSA_CM/ids/ssl/private
    /opt/RSA_CM/ids/ssl/certs
    /opt/RSA_CM/ids/db

*** Unable to load crypto provider : pkcs11v2,/usr/lunasa/lib/libCryptoki2_64.so ***

[XrcBADVALUE: invalid or inappropriate value provided]

Unable to load crypto provider -- see ../conf/ids.conf for detail

*** Operation failed. ***

[XrcBADVALUE: invalid or inappropriate value provided]

configuration parameter is undefined [installMode]
Configuration of installation directory server failed.
Terminating installation prematurely.

Cause
SafeNet Client installed on the system was 64-bit version.  RSA Certificate Manager (RCM) 6.9 is a 32-bit application, and qualified/supported on 64-bit O/S platforms.  When installing RCM, 64-bit version of the SafeNet PKCS#11 library "libCryptoki2_64.so" was selected.  Instead, the 32-bit SafeNet Client / PKCS#11 library "libCryptoki2.so" should be installed and used with RCM.
Resolution
Uninstall the incomplete RCM installation.  Install 32-bit version of SafeNet Client and PKCS#11 libraries.  Then reinstall RCM and choose the 32-bit version of SafeNet PKCS#11 library "libCryptoki2.so".

A request for enhancement CERTMGR-4202 has been submitted to port RSA Certificate Manager product to native 64-bit binaries and to support 3rd party 64-bit software/libraries such as SafeNet Client/PKCS#11.  As of writing this solution, no timeline is available when RCM product will be ported to native 64-bit version.
Workaround
Installing RSA Certificate Manager and chose to search for PKCS#11 cryptographic providers to configure SafeNet PKCS#11 library