Starting the slot manager daemon for openCryptoki – pkcsslotd

Edit online

IBM WebSphere Application Server (WAS) uses the IBM® Java™ PKCS 11 Implementation Provider (IBMPKCS11ImplProvider) to access IBM System z® cryptographic features.

The IBMPKCS11ImplProvider follows the PKCS#11 (openCryptoki) standard and the PKCS#11 main API interacts with the libICA interface library in clear key mode via the ICA token managed by the slot manager daemon.

One part of this cryptographic service-library stack is the pkcsslotd daemon. When the daemon is running, it uses a cryptographic token to manage PKCS#11 objects between PKCS#11 enabled applications.

The openCryptoki package provides a startup script for the pkcsslotd daemon.

Sample command: starting the pkcsslotd daemon

/etc/init.d/pkcsslotd

Novell SLES11 SP2 includes a wrapper script, that can be used for starting and querying the status of the daemon.

Sample command: starting the pkcsslotd daemon and query its status

# rcpkcsslotd start 
Starting pkcsslotd daemon:usermod: `root' is primary group name. done
# rcpkcsslotd status 
Checking for service pkcsslotd:	running

Note: Before using openCryptoki for the very first time on a server the script pkcs11_startup must to be run. The script detects available tokens from installed shared object libraries and writes corresponding records to the pk_config_data file. The pkcsslotd daemon uses this information when it initializes the tokens. The script is automatically called when the daemon is started with the SLES startup script rcpkcsslotd.

Note: The zcrypt device driver must be loaded before you start the pkcsslotd daemon, otherwise openCryptoki does not use any cryptographic hardware features.

The chkconfig command can be used to enable the service startup at system boot time.

# chkconfig -s pkcsslotd <runlevel>