title: SunPKCS11 provider in MacOS for Firefox
body: <p>I managed to get the <code>SunPKCS11</code> to work with Firefox ESR 52.0 under Windows, but I am unable to get it to load in MacOS. I've already tried several different configuration and directly loading it via <code>PKCS11</code> but nothing worked, can anyone give me some pointer?</p>
  
  <p>pkcs11.cfg configuration as follow:</p>
  
  <pre><code>name = FirefoxKeyStore
  library = "/Applications/Firefox.app/Contents/MacOS/fixed-for-java-runtime/libsoftokn3.dylib"
  attributes = compatibility
  nssArgs = "configdir='/Users/helloworld/Library/Application Support/Firefox/Profiles/wasdwasd.default-1453211557245' certPrefix='' keyPrefix='' secmod='secmod.db' flags='readOnly' "
  slot = 2
  </code></pre>
  
  <p>Then in Java, I've tried to load it like this:</p>
  
  <pre><code>FileInputStream fis = new FileInputStream("pkcs11.cfg");
  Provider provider = new SunPKCS11(fis);
  Security.addProvider(provider);
  </code></pre>
  
  <p>However this immediately gives me the following error:</p>
  
  <pre><code>sunpkcs11: Initializing PKCS#11 library /Applications/Firefox.app/Contents/MacOS/fixed-for-java-runtime/libsoftokn3.dylib
  sunpkcs11: Multi-threaded initialization failed: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_DEVICE_ERROR
  Exception in thread "main" java.security.ProviderException: Initialization failed
  at sun.security.pkcs11.SunPKCS11.&lt;init&gt;(SunPKCS11.java:376)
  at sun.security.pkcs11.SunPKCS11.&lt;init&gt;(SunPKCS11.java:107)
  </code></pre>
  
  <p>You maybe asking why do I load the <code>.dylib</code> from the weird folder, that's because I used <code>install_name_tool</code> in MacOS to change the <code>@executable_path</code> to <code>@loader_path</code> in order to get the library dependency to work (since I'm trying to run this in Eclipse rather than from Firefox itself).</p>
  
  <p>I also tried to use the solution suggested here: <a href="https://stackoverflow.com/questions/37868757/how-to-finalize-sunpkcs11-provider-after-it-is-initialized">How to finalize SunPKCS11 Provider after it is initialized?</a> and it was a no-go either... I get the same error.</p>
  
  <p>As well as trying various different configuration settings mentioned here: <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/PKCS11/Module_Specs#Softoken_Specific_Parameters" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/PKCS11/Module_Specs#Softoken_Specific_Parameters</a></p>
  
  <p><strong>EDIT1</strong></p>
  
  <p>I tried the method mentioned by @FaithReaper but it still throw the same error. I tried changing the slot value to <code>0</code>, <code>1</code> or <code>-1</code> and result the same. It looks like there are problem loading the underlaying <code>PKCS11</code> object.</p>
  
  <pre><code>Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_DEVICE_ERROR
  at sun.security.pkcs11.wrapper.PKCS11.C_Initialize(Native Method)
  at sun.security.pkcs11.wrapper.PKCS11$SynchronizedPKCS11.C_Initialize(PKCS11.java:1545)
  at sun.security.pkcs11.wrapper.PKCS11.getInstance(PKCS11.java:157)
  at sun.security.pkcs11.SunPKCS11.&lt;init&gt;(SunPKCS11.java:330)
  </code></pre>
  
  <p>I dunno if this would help, but I ran the <code>modutil</code> on the FireFox profile and is dumping this info:</p>
  
  <pre><code>modutil -dbdir "/Users/eto/Library/Application Support/Firefox/Profiles/ew2g332o.default-1453211557245" -rawlist
  
  library= name="NSS Internal PKCS #11 Module" 
  parameters="configdir=/Users/eto/Library/Application Support/Firefox/Profiles/ew2g332o.default-1453211557245 certPrefix= keyPrefix= secmod=secmod.db flags=readOnly " 
  NSS="Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})"
  </code></pre>
  
  <blockquote>
    <p>Listing of PKCS #11 Modules</p>
    
    <ol>
    <li><p>NSS Internal PKCS #11 Module
     uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.33
    slots: 2 slots attached    status: loaded</p>
    
    <p>slot: NSS Internal Cryptographic Services  token: NSS Generic Crypto
    Services    uri:
    pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203</p>
    
    <p>slot: NSS User Private Key and Certificate Services    token: NSS
    Certificate DB      uri:
    pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203</p></li>
    </ol>
  </blockquote>