# CKR\_USER\_NOT\_LOGGED\_IN Error when Signing ZIP file with Sectigo USB eToken **URL:** \ **Category:** Module Development\ **Created:** [April 6, 2022, 1:33pm UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107 "2022-04-06T13:33:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Ben\_Amar](https://avatars.discourse-cdn.com/v4/letter/b/a88e4f/32.png) [@Ben\_Amar](https://forum.inductiveautomation.com/u/Ben_Amar)\ **Post date:** [April 6, 2022, 1:33pm UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107/1 "2022-04-06T13:33:43Z")
Hey everyone, I have tried to sign a zip file with module-signer code from [GitHub - inductiveautomation/module-signer: A utility that signs modules for use in Ignition](https://github.com/inductiveautomation/module-signer) to create MODL file. We are using Sectigo USB eToken for signing. When we try to sign our ZIP File which contains more than one file, we get this error in the figure below: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/0/e/0e4834b9f1c6e9331608a1bbf74bc03c77ab5084.png) As you can see, the first file /hmi-protection-gateway-1.0.0.jar was successfully signed, but the second file /module.xml failed. Also, it does not matter which files I have tried to sign or the order, it’s just stopped working when attempting to sign the second file. I have tried to debug this, and I have found the exact line where the code raises an exception: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/a/1ab03846c468aff140c3e6218c15ca016d041930.png) The line code 634 failed and raised this exception: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/0/20d48c5a8c934aeeaab3d8cd5f415b9ff9bd6828.png) Nothing that I have tried so far to solve this error works… Any suggestions would be appreciated! Thanks, Ben ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 6, 2022, 1:44pm UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107/2 "2022-04-06T13:44:41Z")
I’m not familiar with the Sectigo product, but I suspect you have the cert installed under the wrong slot ID. Standard slots 0x9a, 0x9c, 0x9d, and 0x9e have different expectations for PIN usage. This Yubikey document spells them out: [https://developers.yubico.com/PIV/Introduction/Certificate\_slots.html](https://developers.yubico.com/PIV/Introduction/Certificate_slots.html) Note 9a and 9d allow multiple signing operations after a single PIN application. 9c needs the PIN for every one. Look for similar information about your Sectigo device. The Yubikey doc implies that non-standard IDs may have configurable behavior. I use slot 0x9a for module signing. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [April 6, 2022, 1:46pm UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107/3 "2022-04-06T13:46:56Z")
Possibly some actionable information here: [Unable to sign using PKCS#11 token · Issue #42 · kaikramer/keystore-explorer · GitHub](https://github.com/kaikramer/keystore-explorer/issues/42) ---
**Author:** ![Brian\_Ray](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@Brian\_Ray](https://forum.inductiveautomation.com/u/Brian_Ray)\ **Post date:** [February 14, 2024, 11:51pm UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107/4 "2024-02-14T23:51:55Z")
I think I hit the same block on a YubiKey 5 NFC using the default signing slot `9c` in enhancing `ignition-module-tools`' `gradle-module-plugin` to [incorporate PKCS#11 signing support](https://github.com/inductiveautomation/ignition-module-tools/issues/41). Then it was possible to hack around that (for now) using Phil's slot `9a` trick above. Longer term I think a password callback handler like the ones mentioned in the link in Kevin's post may be needed to use the YK5's "proper" slot and other HSMs that re-challenge on signing operations. I am a little worried for the potential of every HSM actiing a little differently. [1] This work is in [my fork on GitHub](https://github.com/inductiveautomation/ignition-module-tools/compare/master...brianeray:ignition-module-tools:IGN-7871-pkcs11). The relevant commits are [`6824b81`](https://github.com/inductiveautomation/ignition-module-tools/commit/6824b816614203eec90e03de625d369e853a74cf) and [`bbd1ccd`](https://github.com/inductiveautomation/ignition-module-tools/commit/bbd1ccd23b5831e5ab5b3681f6df4f5a409c1de8). [1] See [Nitrokey attempt stalling out immediately](https://support.nitrokey.com/t/nitrokey-3a-nfc-and-java-sun-pkcs-11/5916), for example. ---
**Author:** ![Brian\_Ray](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@Brian\_Ray](https://forum.inductiveautomation.com/u/Brian_Ray)\ **Post date:** [February 21, 2024, 12:03am UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107/5 "2024-02-21T00:03:14Z")
Draft PR. [inductiveautomation/ignition-module-tools#43](https://github.com/inductiveautomation/ignition-module-tools/pull/43) ---
**Author:** ![Brian\_Ray](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@Brian\_Ray](https://forum.inductiveautomation.com/u/Brian_Ray)\ **Post date:** [March 22, 2024, 9:41pm UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107/6 "2024-03-22T21:41:35Z")
> [@How can we perform code signing using an HSM with module-signer?](https://forum.inductiveautomation.com/t/how-can-we-perform-code-signing-using-an-hsm-with-module-signer/85640/21): > > UPDATE 2024-03-22 That PR has been merged and the Gradle plugin published to our nexus.inductiveautomation.com public repo. Make sure your Gradle project is using 7.6 or later for it to run reliably. To use our Nexus repository for plugin resolution, add the following configurationo to your settings.gradle.kts and build.gradle.kts (if using the Gradle Groovy DSL the syntax is similar): // settings.gradle.kts pluginManagement { repositories { maven { name = "publicNexu… ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 22, 2024, 11:26pm UTC](https://forum.inductiveautomation.com/t/ckr-user-not-logged-in-error-when-signing-zip-file-with-sectigo-usb-etoken/58107/7 "2024-03-22T23:26:03Z")
Will test next week.