How to verify that changes made to cknfastrc file have taken affect for supporting SSL keys based on nCipher/Thales PKCS#11 library?
Originally Published: 2013-04-18
Article Number
Applies To
RSA Certificate Manager 6.8 build 520 (and higher)
nCipher / Thales PKCS#11 Library (cknfast.dll or libcknfast.so)
Issue
How to verify that changes made to cknfastrc file have taken effect for supporting SSL keys based on nCipher/Thales PKCS#11 library
When upgrading or installing RSA Certificate Manager, the installation and administration guides instruct to set the following variables in the nCipher/Thales configuration file C:\nfast\cknfastrc (on Windows) or /opt/nfast/bin/cknfastrc (on Solaris or Linux):
CKNFAST_NO_ACCELERATOR_SLOTS=1
CKNFAST_OVERRIDE_SECURITY_ASSURANCES=import
Resolution
A) PRIOR to updating the configuration file cknfastrc, run the nCipher tools ckcheckinst and ckinfo as described in the RSA Certificate Manager guides. The output for these commands may look like the following:
SAMPLE OUTPUT for ckcheckinst (BEFORE updating cknfastrc):
C:\nfast\bin>ckcheckinst.exe
PKCS#11 library interface version 2.01
flags 0
manufacturerID "nCipher Corp. Ltd "
libraryDescription "nCipher PKCS#11 1.48.25 "
implementation version 1.48
Slot Status Label
==== ====== =====
0 Fixed token "accelerator "
1 Operator card "MyTestOCS "
Select slot number to run library test or 'R'etry or to 'E'xit:
SAMPLE OUTPUT for ckinfo (BEFORE updating cknfastrc):
C:\nfast\bin>ckinfo.exe
PKCS#11 library CK_INFO
interface version 2.01
flags 0
manufacturerID "nCipher Corp. Ltd "
libraryDescription "nCipher PKCS#11 1.48.25 "
implementation version 1.48
slots[0] CK_SLOT_INFO
slotDescription "7E11-D9B6-48CA Rt1 "
manufacturerID "nCipher Corp. Ltd "
flags 5
flags & CKF_TOKEN_PRESENT
flags & CKF_HW_SLOT
hardware version 0.07
firmware version 2.22
slots[0] CK_TOKEN_INFO
label "accelerator "
manufacturerID "nCipher Corp. Ltd "
model " "
serialNumber "7E11-D9B6-48CA "
flags 201
flags & CKF_RNG
flags & CKF_DUAL_CRYPTO_OPERATIONS
ulMaxSessionCount 1024
ulMaxRwSessionCount 1024
ulMaxPinLen 256
ulMinPinLen 0
ulTotalPublicMemory CK_UNAVAILABLE_INFORMATION
ulFreePublicMemory CK_UNAVAILABLE_INFORMATION
ulTotalPrivateMemory CK_UNAVAILABLE_INFORMATION
ulFreePrivateMemory CK_UNAVAILABLE_INFORMATION
hardware version 0.07
firmware version 2.22
utcTime " "
slots[1] CK_SLOT_INFO
slotDescription "7E11-D9B6-48CA Rt1 slot 0 "
manufacturerID "nCipher Corp. Ltd "
flags 7
flags & CKF_TOKEN_PRESENT
flags & CKF_REMOVABLE_DEVICE
flags & CKF_HW_SLOT
hardware version 0.07
firmware version 2.22
slots[1] CK_TOKEN_INFO
label "MyTestOCS "
manufacturerID "nCipher Corp. Ltd "
model " "
serialNumber "abdc4341cf8e0b14"
flags 20D
flags & CKF_RNG
flags & CKF_LOGIN_REQUIRED
flags & CKF_USER_PIN_INITIALIZED
flags & CKF_DUAL_CRYPTO_OPERATIONS
ulMaxSessionCount 1024
ulMaxRwSessionCount 1024
ulMaxPinLen 256
ulMinPinLen 0
ulTotalPublicMemory CK_UNAVAILABLE_INFORMATION
ulFreePublicMemory CK_UNAVAILABLE_INFORMATION
ulTotalPrivateMemory CK_UNAVAILABLE_INFORMATION
ulFreePrivateMemory CK_UNAVAILABLE_INFORMATION
hardware version 0.07
firmware version 2.22
utcTime " "
B) AFTER updating the configuration file cknfastrc, run the nCipher tools ckcheckinst and ckinfo as described in the RSA Certificate Manager guides (and restarting nCipher hardserver). The output for these commands may look like the following:
SAMPLE OUTPUT for ckcheckinst (AFTER updating cknfastrc):
C:\nfast\bin>ckcheckinst.exe
PKCS#11 library interface version 2.01
flags 0
manufacturerID "nCipher Corp. Ltd "
libraryDescription "nCipher PKCS#11 1.48.25 "
implementation version 1.48
Slot Status Label
==== ====== =====
0 Fixed token "accelerator "
1 Operator card "MyTestOCS "
Select slot number to run library test or 'R'etry or to 'E'xit:
NOTICE that the output for ckcheckinst has not changed and the accelerator slot still shows. As per nCipher documentation, if the variable CKNFAST_NO_ACCELERATOR_SLOTS is set, the nCipher PKCS#11 does not create the accelerator slot and the library only presents the smart card slots. However, setting this environment variable has no effect on ckcheckinst because ckcheckinst needs to list accelerator slots.
SAMPLE OUTPUT for ckinfo (AFTER updating cknfastrc):
C:\nfast\bin>ckinfo.exe
PKCS#11 library CK_INFO
interface version 2.01
flags 0
manufacturerID "nCipher Corp. Ltd "
libraryDescription "nCipher PKCS#11 1.48.25 "
implementation version 1.48
slots[0] CK_SLOT_INFO
slotDescription "7E11-D9B6-48CA Rt1 slot 0
manufacturerID "nCipher Corp. Ltd "
flags 7
flags & CKF_TOKEN_PRESENT
flags & CKF_REMOVABLE_DEVICE
flags & CKF_HW_SLOT
hardware version 0.07
firmware version 2.22
slots[0] CK_TOKEN_INFO
label "MyTestOCS "
manufacturerID "nCipher Corp. Ltd "
model " "
serialNumber "abdc4341cf8e0b14"
flags 20D
flags & CKF_RNG
flags & CKF_LOGIN_REQUIRED
flags & CKF_USER_PIN_INITIALIZED
flags & CKF_DUAL_CRYPTO_OPERATIONS
ulMaxSessionCount 1024
ulMaxRwSessionCount 1024
ulMaxPinLen 256
ulMinPinLen 0
ulTotalPublicMemory CK_UNAVAILABLE_INFORMATION
ulFreePublicMemory CK_UNAVAILABLE_INFORMATION
ulTotalPrivateMemory CK_UNAVAILABLE_INFORMATION
ulFreePrivateMemory CK_UNAVAILABLE_INFORMATION
hardware version 0.07
firmware version 2.22
utcTime " "
NOTICE that only slot 0 is listed which maps to smart card slot, the accelerator slot does not show. When prompted for slot number on RSA Certificate Manager, slot number should be entered as "1" and this will map to the smart card slot being shown above as "0".
Notes
Related Articles
Changes to JSP files require an application restart to take effect in RSA Identity Governance & Lifecycle Number of Views If the RSA Identity Governance and Lifecycle Rule Status is invalid, a Segregation of Duties (SOD) rule definition takes … Number of Views Collection Data Pre-Processing takes longer and longer to complete in RSA Identity Governance & Lifecycle Number of Views Data Purging after Data Archiving run may take longer than expected in RSA Identity Governance & Lifecycle Number of Views Changes to Forms in Workflow Approval and Activity Nodes require an application restart to take effect in RSA Identity Gov… Number of Views
Trending Articles
RSA Authentication Manager 8.9 Setup and Configuration Guide RSA Authentication Manager 8.9 Release Notes (January 2026) RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide How to 'Trust' the RSA Authentication Manager Security Console Self-Signed Root CA certificate and prevent Cert warnings. RSA Authentication Manager Upgrade Process
Don't see what you're looking for?
