не удаётся записать сертификат на Rutoken ECP в OracleLinux/RHEL 8.5
форматирую токен
$ pkcs15-init --erase-card --reader 0
$ pkcs15-init --reader 0 --create-pkcs15 --so-pin "87654321" --so-puk ""
$ pkcs15-init --reader 0 --store-pin --label "User PIN" --auth-id 02 --pin "12345678" --puk "" --so-pin "87654321" --finalizeтокен виден
$ pkcs15-tool -v -D --reader 0
Connecting to card in reader Aktiv Rutoken ECP 00 00...
Using card driver Rutoken ECP and Lite driver.
Trying to find a PKCS#15 compatible card...
Found Rutoken ECP!
PKCS#15 Card [Rutoken ECP]:
Version : 0
Serial number : 0000000029875944
Manufacturer ID: Aktiv Co.
Last update : 20220420214735Z
Flags : EID compliant
Card has 2 Authentication object(s).
PIN [Security Officer PIN]
Object Flags : [0x03], private, modifiable
ID : 01
Flags : [0x99], case-sensitive, unblock-disabled, initialized, soPin
Length : min_len:8, max_len:32, stored_len:32
Pad char : 0x00
Reference : 1 (0x01)
Type : ascii-numeric
PIN [User PIN]
Object Flags : [0x03], private, modifiable
ID : 02
Flags : [0x19], case-sensitive, unblock-disabled, initialized
Length : min_len:4, max_len:32, stored_len:32
Pad char : 0x00
Reference : 2 (0x02)
Type : ascii-numeric
Card has 0 Private key(s).
Card has 0 Public key(s).
Card has 0 Secret key(s).
Card has 0 Certificate(s).
Card has 0 Data object(s).создаю ключевую пару и отправляю запрос на сертификацию в файл
$ pkcs11-tool --module /usr/lib64/librtpkcs11ecp.so --keypairgen --key-type "rsa:2048" -l -p "12345678" --id 41 --label "KeyPairRSA-regl1" --slot-description "Aktiv Rutoken ECP 00 00"
Key pair generated:
Private Key Object; RSA
label: KeyPairRSA-regl1
ID: 41
Usage: decrypt, sign, unwrap
Access: sensitive, always sensitive, never extractable, local
Public Key Object; RSA 2048 bits
label: KeyPairRSA-regl1
ID: 41
Usage: encrypt, verify, wrap
Access: local
$ openssl
OpenSSL> engine dynamic -pre SO_PATH:/usr/lib64/engines-1.1/pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib64/librtpkcs11ecp.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib64/engines-1.1/pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Success]: LOAD
[Success]: MODULE_PATH:/usr/lib64/librtpkcs11ecp.so
Loaded: (pkcs11) pkcs11 engine
OpenSSL> req -engine pkcs11 -new -key 0:41 -keyform engine -out cert-req-regl1-2022.pem -text -subj "/C=RU/ST=Moscow/L=Moscow/O=Inbank Ltd/OU=IT/CN=regl1"
engine "pkcs11" set.
Enter PKCS#11 token PIN for Rutoken ECP <no label>:
OpenSSL> exit
$ ls -l cert-req-regl1-2022.pem
-rw-rw-r--. 1 regl1 regl1 3482 Apr 21 01:00 cert-req-regl1-2022.pemполучаю от УЦ сертификат и пытаюсь записать его на тот же рутокен, запись не происходит, на токене вижу только ключевую пару
$ ls -l regl1-2022.cer
-rw-r--r--. 1 regl1 regl1 1756 Apr 21 01:06 regl1-2022.cer
$ pkcs11-tool --module /usr/lib64/librtpkcs11ecp.so -l -y cert -w regl1-2022.cer --id 41 --slot-description "Aktiv Rutoken ECP 00 00"
Logging in to "Rutoken ECP <no label>".
Please enter User PIN:
error: PKCS11 function C_CreateObject failed: rv = CKR_FUNCTION_FAILED (0x6)
Aborting.
$ pkcs11-tool --module /usr/lib64/librtpkcs11ecp.so -l -O --slot-description "Aktiv Rutoken ECP 00 00"
Logging in to "Rutoken ECP <no label>".
Please enter User PIN:
Public Key Object; RSA 2048 bits
label: KeyPairRSA-regl1
ID: 41
Usage: encrypt, verify, wrap
Access: local
Private Key Object; RSA
label: KeyPairRSA-regl1
ID: 41
Usage: decrypt, sign, unwrap
Access: sensitive, always sensitive, never extractable, local
$подскажите, что я делаю не так?