Page Comparison

We do not recommend mixing dynamic and static configuration (i.e., using --pkcs11Config with a modified java.security file, as this can cause two copies of the provider to be loaded. This may result in hard to debug errors, such as "Private keys must be instance of RSAPrivate(Crt)Key or have PKCS#8 encoding" or "No installed provider supports this key".

...xmlsectool.sh --sign --pkcs11Config /path/to/config.cfg \
   --keykeyAlias key2048 --keyPassword 1234 \
   --inFile unsigned.xml --outFile signed.xml 

...xmlsectool.sh --verifySignature --pkcs11Config /path/to/config.cfg \
   --keykeyAlias key2048 --keyPassword 1234 \
   --inFile signed.xml

...xmlsectool.sh --sign --keystore /dev/null --keystoreType PKCS11 \
   --keykeyAlias key2048 --keyPassword 1234 \
   --inFile unsigned.xml --outFile signed.xml