Getting The error 43000070:PKCS#11 module::Mechanism invalid
indicates a cryptographic mechanism mismatch between Azure IoT C SDK and your Swissbit HSM.
After checking more getting got to know The Azure IoT C SDK uses OpenSSL's TLS implementation, which is attempting a handshake with a cryptographic mechanism (e.g., specific key exchange algorithm or signature scheme) unsupported by your HSM's PKCS#11 module. This often occurs when:
The HSM's PKCS#11 driver lacks support for the TLS cipher suites required by Azure IoT Hub.
The X.509 certificate uses an unsupported key type (e.g., RSA vs. ECC).
- The PKCS#11 library configuration is missing required mechanisms.
we have checked by mechanisms supported by swissbit then cross verify with azure cipher suites
The ECDSA suites will work if TLS1.2 and only selected region of azure is added in IoTHub and sadly our current settings has TLS1.2 but the region does support this mechanisms. Only left with TLS1.0 with the cipher suites supported by azure those are TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA. We then added these in azure sdk to use only above ciphers but found that these ciphers are also not supported and requires TLS1.2.
Below is the error in more detail:
Creating IoTHub handle Sending message 1 to IoTHub Enter PKCS#11 token PIN for JavaCard isoApplet (User PIN): Sending message 2 to IoTHub Sending message 3 to IoTHub Sending message 4 to IoTHub Sending message 5 to IoTHub Error: Time:Wed Mar 26 21:34:23 2025 File:/home/virifi-studio/azure-iot-sdk-c/c-utility/adapters/tlsio_openssl.c Func:send_handshake_bytes Line:734 error:43000070:PKCS#11 module::Mechanism invalid Error: Time:Wed Mar 26 21:34:23 2025 File:/home/virifi-studio/azure-iot-sdk-c/umqtt/src/mqtt_client.c Func:onOpenComplete Line:452 Error: failure opening connection to endpoint.
Kindly provide insights on resolving it.