Hi,
The current GUI user experience when using PKCS11 could be improved. For signing PDF's with certificate on card - such as national ID in for example Croatia via Certilia Client PKCS11, there is no easy way to start with jsignpdf. I was only able to sign PDF after troubleshooting session with help of AI/LLM to configure and use the, otherwise, really great tool.
1.) PCKS11 option missing from keystore type dropdown menu.
Even on first launch of application there should be keystore type "PKCS11" menu available but should state that PKCS11 is not configured. At least then you know that there is something you need to do, maybe point to documentation at this point (which also could be improved).
2.) Configuring PCKS#11 provider in preferences
There should be some default options for some common providers, I don't know the details but web browsers can detect those providers on Windows and prompt for certificate selection. Not just web browser but other common PDF signing tools on Windows (Adobe Acrobat, Foxit Reader, ...) just prompt the user with available certificates from hardware devices available - how to achieve this here?
Even file picker for ".so" or ".dll" would help a lot to new users because the path is different depending on platform (Linux, Windows, ...).
In my case, here is working pkcs11.cfg configuration that enabled PKCS11 keystore option (see point 1 above)
name = Certilia
library = "C:/Program Files/AKD/Certilia Middleware/pkcs11/CertiliaPkcs11_64.dll"
slot=1
3.) PKCS11 loading breaks the startup sequence
If you configure wrong .dll / .so in pkcs11.cfg, for example, you choose 32-bit library instead of 64-bit the GUI of jsignpdf doesn't start at all. You need to start jsignpdfc and then you'll see errors in command line, then you need to go to manually edit pkcs11.cfg via notepad. Horrible user experience.
4.) Two PKCS11 options - which one is the right one?
When you finally have PKCS11 provider set up in setting only then there is dropdown menu in "Keystore type" but there are two of them. For me, only option "PKCS11" worked but there was also JSIGNPKCS11 which didn't work. I don't know the reason - maybe its platform dependant (for example one is for Linux the other is for Windows) but there should be more clarity here.
5.) PKCS11 is not on a filesystem!
When choosing keystore type of PKCS#11 the "keystore file" file picker should be hidden from GUI because the certificate is and stays on hardware device.
The button "Load Keys" and the whole flow for loading keys is confusing. It is not clear that you need to click "Load Keys" to continue with workflow or to test the password correctness you entered above.
Errors regarding "Load Keys" appear in output console without any GUI signal.
If "Load Keys" operation is successful then in output console there is no information about that (it only says "Getting key alias") - no clear sign of success.
Hi,
The current GUI user experience when using PKCS11 could be improved. For signing PDF's with certificate on card - such as national ID in for example Croatia via Certilia Client PKCS11, there is no easy way to start with jsignpdf. I was only able to sign PDF after troubleshooting session with help of AI/LLM to configure and use the, otherwise, really great tool.
1.) PCKS11 option missing from keystore type dropdown menu.
Even on first launch of application there should be keystore type "PKCS11" menu available but should state that PKCS11 is not configured. At least then you know that there is something you need to do, maybe point to documentation at this point (which also could be improved).
2.) Configuring PCKS#11 provider in preferences
There should be some default options for some common providers, I don't know the details but web browsers can detect those providers on Windows and prompt for certificate selection. Not just web browser but other common PDF signing tools on Windows (Adobe Acrobat, Foxit Reader, ...) just prompt the user with available certificates from hardware devices available - how to achieve this here?
Even file picker for ".so" or ".dll" would help a lot to new users because the path is different depending on platform (Linux, Windows, ...).
In my case, here is working
pkcs11.cfgconfiguration that enabled PKCS11 keystore option (see point 1 above)3.) PKCS11 loading breaks the startup sequence
If you configure wrong .dll / .so in
pkcs11.cfg, for example, you choose 32-bit library instead of 64-bit the GUI of jsignpdf doesn't start at all. You need to start jsignpdfc and then you'll see errors in command line, then you need to go to manually edit pkcs11.cfg via notepad. Horrible user experience.4.) Two PKCS11 options - which one is the right one?
When you finally have PKCS11 provider set up in setting only then there is dropdown menu in "Keystore type" but there are two of them. For me, only option "PKCS11" worked but there was also JSIGNPKCS11 which didn't work. I don't know the reason - maybe its platform dependant (for example one is for Linux the other is for Windows) but there should be more clarity here.
5.) PKCS11 is not on a filesystem!
When choosing keystore type of PKCS#11 the "keystore file" file picker should be hidden from GUI because the certificate is and stays on hardware device.
The button "Load Keys" and the whole flow for loading keys is confusing. It is not clear that you need to click "Load Keys" to continue with workflow or to test the password correctness you entered above.
Errors regarding "Load Keys" appear in output console without any GUI signal.
If "Load Keys" operation is successful then in output console there is no information about that (it only says "Getting key alias") - no clear sign of success.