Generating a keypair on a Nitrokey HSM fails

Thore Göbel
2026-01-07T14:26:06Z

On the Nitrokey HSM that I have, `keytool` cannot generate private keys via PKCS#11.

I have posted about this on the [Nitrokey forum](https://support.nitrokey.com/t/keygen-with-java-keytool-fails-on-nitrokey-hsm/7427).
The underlying cause -- as I understand it so far -- is that `keytool` doesn't actually generate a key pair on the HSM; it instead generates it in software and tries to import it (which the Nitrokey HSM denies).

## Steps to reproduce

- `fdroid init`
- Edit the `config.yml` to set the `repo_keyalias, keystore: NONE, keystorepass` and the other relevant options
- `fdroid update --create-key`

## System info

- Debian 13 (Trixie)
- Java 21 (from apt)
- fdroidserver 2.4.2 (from stable apt, NO backport)

## Log

The TLDR of the human-facing error message is:

```
keytool error: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_FUNCTION_NOT_SUPPORTED
```

The full log, including the opensc debug trace, is very similar to the one I posted in to Nitrokey forum.

## Context

I am somewhat surprised, because `fdroid update --create-key` seems to work with a Nitrokey HSM for @Bubu in https://f-droid.org/en/2020/10/05/ntrokey-signing.html ? Idk what has changed since.

## Workaround

The same workaround that I describe in the Nitrokey forum for generating a key a single APK should also work for generating a key for the repo index:

1. Generate an RSA key pair with `pkcs11-tool`
1. Generate a self-signed certificate with `certtool`
1. Load the cert onto the Nitrokey with `pkcs11-tool`

Doing this got be one step closer to signing the repo index. However, then I ran into another bug (see https://gitlab.com/fdroid/fdroidserver/-/issues/1313).