Verified libp11 0.4.12-1.1ubuntu2 from noble-proposed on a real affected machine.
Environment: - Ubuntu 24.04, openssl 3.0.13-0ubuntu3.16 - libengine-pkcs11-openssl 0.4.12-1.1ubuntu2 (noble-proposed) - wpa_supplicant + NetworkManager, EAP-TLS (802.1X Wi-Fi, TLSv1.2) - TPM 2.0 (STMicroelectronics), client key in a tpm2-pkcs11 token via p11-kit Before: with 0.4.12-1.1ubuntu1 the connection failed with "Esys_StartAuthSession: Could not create rsa key" and "ENGINE: cannot load private key ... operation not supported for this keytype". The machine had been held on 0.4.12-1.1build2. Test: 1. Upgraded from 0.4.12-1.1build2 to 0.4.12-1.1ubuntu2 from noble-proposed; no other packages changed. 2. Restarted wpa_supplicant and NetworkManager and connected. 3. Disconnected and reconnected 3 times without restarting wpa_supplicant (the regression was process-lifetime state). Each was a full handshake (tls_session_reused=0, new EAP session ID each time). Result: EAP state=SUCCESS, suppPortStatus=Authorized on every connection, with production network access. No "Could not create rsa key" and no "Workaround for OpenSSL" messages in the wpa_supplicant journal. Note this was tested together with openssl 3.0.13-0ubuntu3.16, the combination planned for release. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163152 Title: [SRU] EAP-TLS Wi-Fi broken with TPM-backed PKCS#11 keys after upgrade to 0.4.12-1.1ubuntu1 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libp11/+bug/2163152/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
