PKCS11 tokens that don't support RSA-PSS don't work. We should make sure the mechanism is supported or handle the error about ghostunnel

[mcpherrinm]

Is the pkcs11 DLL provided by your HSM vendor? Are you willing to share what vendor that is?

There's no flag for this, but I wonder if it has to do with RSA-PSS in TLS1.3. Do you know if the server you're connecting to supports TLS1.3?

If you've got any Go experience, can you try adding a MaxVersion: tls.TlsVersionTLS12 around here: https://github.com/ghostunnel/ghostunnel/blob/master/tls.go#L115 and see if that works?

Otherwise we might have to add a bit of debugging to log what parameters it's unhappy with.

[fliot]

Hi,
Thanks for your feedback,
Indeed, with this

MaxVersion:               tls.VersionTLS12,
Renegotiation: tls.RenegotiateOnceAsClient,

I got some success, and definitively TLS1.3 is blocking, due to my HSM/pkcs11 DLL functions.
Great thanks for your support.

[mcpherrinm]

I'm going to keep this open as a bug, as it would be reasonable to support these tokens but limited to TLS 1.2, or at least produce a better error message