Cannot importca with nCipher HSM - Crypto Token was offline. Make sure the P11 library null is accessible.

[christopherconway1-hash]

Ran command form ejbca-ce container:

/opt/keyfactor/bin/ejbca.sh ca importca --caname CA-Test --hard --tokenname token2 --cert /migration/CA-Test.pem --ctpassword FOOBAR123 --prop TESTCAImport.properties

2026-02-04 16:45:44,412+0000 INFO [org.ejbca.ui.cli.ca.CaImportCACommand] (main) Importing HSM token.
2026-02-04 16:45:44,503+0000 ERROR [org.ejbca.ui.cli.ca.CaImportCACommand] (main) Crypto Token was offline. Make sure the P11 library null is accessible.

from the container I can set HSM, I can see the card. From the admin GUI I was able to create the token2 Crypto Token and I can see and test all the keys successfully:

Keypair with alias tested successfully using signing and verification operations.

The properties file:
defaultKey CA-Test
certSignKey CA-Test
crlSignKey CA-Test
pin FOOBAR123
sharedLibrary /opt/nfast/toolkits/pkcs11/libcknfast.so

library matches permissions on local RFS.

[primetomas]

Remove:
pin FOOBAR123
sharedLibrary /opt/nfast/toolkits/pkcs11/libcknfast.so

from the properties file, since the crypto token already exists these are not needed. Also view server.log when doing the import command.

[christopherconway1-hash]

Thanks for the reply. I've copied a modified properties file as you suggested, same error. Here is server.log:

2026-02-05 13:54:53,307+0000 WARN [com.keyfactor.util.keys.token.BaseCryptoToken] (default task-2) Can not read public key certificate with alias 'CA-Test - CS, CRLS' from Crypto Token, got null. If the key of the certificate was generated after the latest application server start then restart the application server.

[christopherconway1-hash]

I've restarted the container, and the host (which is also the RFS), same issue remains.

2026-02-05 13:54:53,335+0000 ERROR [org.ejbca.ui.cli.ca.CaImportCACommand] (main) Crypto Token was offline. Make sure the P11 library null is accessible.

[primetomas]

This alias name looks very strange, I guess this alias doesn't exist on the HSM. "CA-Test - CS, CRLS"

[christopherconway1-hash]

I will double check to make sure the correct alias is being used. That is the label I pulled from /opt/nfast/bin/cklist command:

/opt/nfast/bin/cklist | grep CRL
Passphrase: **********
CKA_LABEL "CA Test - CS, CRLS"

[primetomas]

Ah, it just didn't match the values you posted from the beginning.
I always advice against being too human readable with machine-processed labels, you never know which system doesn't like various special characters. Some HSMs don't allow _, others not -, and yet others not ,... I don't know if this is relevant for this topic but I would rename it to something simpler.
Assuming that you can actually use the keys using a "clientToolBox test" command? That is the first basic test that you can use these keys with EJBCA.

[christopherconway1-hash]

@primetomas thank you so much for your time and advice....

I have some progress...but new errors.

I changed the properties to point defaultKey, certSignKey & crlSignKey to the applicable alias that is displayed from the crypto token that I had added successfully.

new error:

Exception in thread "main" jakarta.ejb.EJBException: java.lang.NullPointerException: Cannot invoke "String.toCharArray()" because "keystorepass" is null

detailed logs (docker logs -f --since 5m ejbca-ce):

2026-02-05 16:40:45,608+0000 ERROR [org.jboss.as.ejb3.invocation] (default task-2) WFLYEJB0034: Jakarta Enterprise Beans Invocation failed on component CAAdminSessionBean for method public abstract void org.ejbca.core.ejb.ca.caadmin.CAAdminSession.importCAFromHSM(org.cesecore.authentication.tokens.AuthenticationToken,java.lang.String,java.security.cert.Certificate[],java.lang.String,java.lang.String,java.lang.String,java.lang.String) throws com.keyfactor.util.keys.token.CryptoTokenOfflineException,com.keyfactor.util.keys.token.CryptoTokenAuthenticationFailedException,org.cesecore.keys.token.IllegalCryptoTokenException,org.cesecore.certificates.ca.CAExistsException,org.cesecore.authorization.AuthorizationDeniedException,org.cesecore.certificates.ca.CAOfflineException,com.keyfactor.util.keys.token.pkcs11.NoSuchSlotException: jakarta.ejb.EJBException: java.lang.NullPointerException: Cannot invoke "String.toCharArray()" because "keystorepass" is null

[christopherconway1-hash]

@primetomas Its resolved! I had to add the --ctpassword string into the importca command; ive imported successfully. Thanks for assist(s).