808bits

CKR_TOKEN_NOT_RECOGNIZED

PKCS#11 return value · 0x000000E1 · decimal 225
hex 0x000000E1 decimal 225 name CKR_TOKEN_NOT_RECOGNIZED

There is a device in the slot, which is what separates this code from the empty-slot one, and the library cannot make a token out of it. Nearly every report comes from a smart card library: a card carrying an applet the library does not know, a card it knows but which was never personalised, or a reader returning nonsense after a bad insertion. Network HSM libraries and software tokens hardly ever return it.

What the token is reporting

The slot reports something present, and the library does not recognise it as a token it can drive. No session was opened and nothing was authenticated.

Likely causes

Ordered by how often they turn out to be the answer. That ordering is a judgement from experience, not a measured frequency.

The card carries no application this library supports

The library matches cards by their answer to reset and by the applications it can select. A card with a different applet, or the right applet behind a different answer to reset, is present but unusable. Corporate badges and government cards mixed with a library that expects only one family are the usual case.

Check it: Read the card’s answer to reset with the library’s own card tool and check it against the library’s driver list.

Fix: Use the library or driver that matches the card. There is no way to make a library recognise an applet it does not implement.

The card is supported and blank

A card that has not been initialised with its file structure answers the selection but has nothing behind it. Some libraries report that as not initialised and others as not recognised, and the second is more confusing since the card is entirely the right kind.

Check it: Run the library’s initialisation or listing tool against the card. A blank card is reported as such there.

A transient read failure from the reader

A partially inserted contact card or a contactless card that moved during the answer to reset gives the library a truncated answer, and the failure to match it comes out as this code.

Check it: Remove and reinsert the card and repeat. A failure that does not reproduce was the reader.

A different card was swapped in mid-session

Smart card libraries translate their wrong-card error into this code, so it can appear on a login or an operation in a session that was opened against the previous card in the same reader.

Check it: Check whether the card changed between the session open and the failing call.

Which calls return it

C_GetTokenInfo, C_OpenSession, C_InitToken, C_Login

What it is not

It is not an empty slot, which is CKR_TOKEN_NOT_PRESENT, and it is not an HSM refusing you on policy. On a network HSM the partition either appears or it does not, and this code is not how it says no.

Often confused with

  • CKR_TOKEN_NOT_PRESENT: Empty slot versus occupied slot with an unknown occupant. The difference between them is the whole diagnosis.
  • CKR_DEVICE_ERROR: A card that answers and then fails is a device error. One that never answers in a way the library can use is this code.
  • CKR_SLOT_ID_INVALID: The slot number itself was wrong, so no device was examined at all.

By library

OpenSC

Three card-layer errors become this code, for an invalid card, a wrong card and a card with no support (misc.c). Login also returns it when the slot has no card object behind it (pkcs11-session.c), and slot enumeration uses it internally while detecting cards.

SoftHSMv2

Never returned. A software token is always recognised.

IBM opencryptoki

Never returned. The name appears only in the table that turns codes into strings.

YubiHSM 2

Never returned. A connector that cannot be reached is reported as token not present instead.

Sources

Every description, cause and check on this page is written from scratch. The specification is cited for the constant's name and its number, which are facts, and for nothing else.