ENTERPRISE  This is a SignServer Enterprise feature.


Crypto token generating keys in the token and exporting them wrapped with a symmetric key and stored in the database.

Note that the JackNJI11KeyWrappingCryptoToken has been renamed P11NGKeyWrappingCryptoToken as of SignServer 6.0.


In most cases this crypto token is not used directly but instead using a P11NGKeyWrappingCryptoWorker.

Available Properties



DEFAULTKEYKey alias of the secret/symmetric wrapping key in the token that should be used to wrap and unwrap keys. Required.
WRAPPED_TESTKEYKey alias of wrapped key stored in the database that can be used to test that unwrapping is working. If specified, the worker will be offline if a test signing cannot be performed with this key. Optional.
PINAuthentication code for activation. Only required for auto-activation, otherwise manual activation can be performed.

Name of pre-defined PKCS11 library to be used. The available libraries can be configured in signserver_deploy.properties. Required.

SLOTLABELTYPEIndicates how the slot should be identified. Supported values are SLOT_NUMBER, or SLOT_INDEX. Required.

The slot to use, identified with the type specified in SLOTLABELTYPE:

  • SLOT_NUMBER is the number (ID) of the slot
  • SLOT_INDEX is the zero-base index of the slot in the list of available slots as returned by the PKCS#11 provider


(warning) SLOT_LABEL is currently not supported.


Cipher algorithm used to wrap the keys by secret/symmetric key. The value can be provided as PKCS#11 mechanism name, long constant value, or hexadecimal constant value. See Wrapping Cipher Algorithm below. (Optional).

Default value is CKM_AES_CBC_PAD.

USE_CACHESpecify if key and certificate search results from the HSM should be cached. This can prevent problems due to too many find object requests under high load with some PKCS#11 implementations. Optional: default true.

Wrapping Cipher Algorithm

The Wrapping Cipher Algorithm is used to wrap the keys by secret/symmetric key. Values can be supplied in the following ways:

PKCS#11 mechanism name

Stating with "CKM_". Example: CKM_AES_CBC_PAD.

CKM Long value

Example: 4229. Here 4229 represents long value for CKM_AES_CBC_PAD constant, as per PKCS11 specification.

CKM Hexadecimal value

Example: 0x00001085. Here 0x00001085 represents hexadecimal value for CKM_AES_CBC_PAD constant, as per PKCS11 specification.

Which algorithm can be used depends on the underlying CryptoToken and the Hardware Security Module.

Specifically, SoftHSMv2 does not support CKM_AES_CBC_PAD. See SoftHSMv2 issue #229 for more information. But as described above other mechanism can potentially be used and even using numeric value in case there is not yet a constant for it in SignServer. For instance it has been reported that CKM_AES_KEY_WRAP works if it is specified as value 8457.

NoDB Mode

Crypto token features like generate key, remove key, generate CSR, and import certificate are not supported by this token in NoDB mode since it requires a database connection.