<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
<a href="https://gitlab.com/filhocf">Claudio Ferreira</a> created an issue: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1798">#1798</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<h2 id="user-content-context" dir="auto" style="margin-top: 0px; margin-bottom: 10px;" align="initial">Context<a href="#context" aria-label="Link to heading 'Context'" data-heading-content="Context" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">This issue was discovered while investigating OpenConnect VPN client authentication failures with PKCS#11 tokens.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial"><strong style="font-weight: 600; margin-top: 0px;">OpenConnect issue <a href="https://gitlab.com/gnutls/gnutls/-/issues/835" title="nettle 3.5 issues/warnings" class="gfm gfm-issue" data-original="#835" data-link="false" data-link-reference="false" data-issue="24788150" data-project="179611" data-iid="835" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">#835 (closed)</a></strong>: "GnuTLS backend does not initialize PKCS#11 modules"</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">URL: <a href="https://gitlab.com/openconnect/openconnect/-/issues/835" title="PKCS#11 modules not initialized when using GnuTLS backend with certificate authentication Description:" class="gfm gfm-issue" data-original="https://gitlab.com/openconnect/openconnect/-/issues/835" data-link="false" data-link-reference="true" data-issue="184038675" data-project="2335175" data-iid="835" data-namespace-path="openconnect/openconnect" data-project-path="openconnect/openconnect" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">openconnect/openconnect#835</a>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">OpenConnect maintainer (Dimitri Papadopoulos) suggested this is a GnuTLS bug</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">OpenConnect calls multiple <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_*()</code> functions but auto-init doesn't trigger</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Workaround being implemented in OpenConnect pending GnuTLS fix</li>
</ul>
<h2 id="user-content-summary" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Summary<a href="#summary" aria-label="Link to heading 'Summary'" data-heading-content="Summary" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">GnuTLS 3.8.12 does not automatically initialize PKCS#11 modules when applications call <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_*()</code> functions, despite documentation stating that <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_init()</code> is called automatically since version 3.3.0.</p>
<h2 id="user-content-environment" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Environment<a href="#environment" aria-label="Link to heading 'Environment'" data-heading-content="Environment" class="anchor" style="margin-top: 0px;"></a>
</h2>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<strong style="font-weight: 600; margin-top: 0px;">GnuTLS</strong>: 3.8.12-2</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<strong style="font-weight: 600; margin-top: 0px;">p11-kit</strong>: 0.25.10</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<strong style="font-weight: 600; margin-top: 0px;">OS</strong>: Debian GNU/Linux Sid</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<strong style="font-weight: 600; margin-top: 0px;">Application</strong>: OpenConnect 9.12</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<strong style="font-weight: 600; margin-top: 0px;">Token</strong>: G&D StarSign CUT S (SafeSign IC driver)</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<strong style="font-weight: 600; margin-top: 0px;">Certificate</strong>: ICP-Brasil A3</li>
</ul>
<h2 id="user-content-expected-behavior" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Expected Behavior<a href="#expected-behavior" aria-label="Link to heading 'Expected Behavior'" data-heading-content="Expected Behavior" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">According to GnuTLS documentation:</p>
<blockquote dir="auto" style="font-size: inherit; color: #626168; padding-top: 0.5rem; padding-bottom: 0.5rem; padding-left: 1rem; border-left-style: solid; margin: 0.5rem 0px; border-color: #bfbfc3; border-width: 0 0 0 4px;" align="initial">
<p style="color: inherit; line-height: 1.5; margin: 0;">Since GnuTLS 3.3.0 this function is no longer necessary to be explicitly called. It is being called during the first request PKCS 11 operation.</p>
</blockquote>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">When an application calls <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_*()</code> functions (e.g., when processing a PKCS#11 URI), GnuTLS should automatically initialize PKCS#11 modules.</p>
<h2 id="user-content-actual-behavior" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Actual Behavior<a href="#actual-behavior" aria-label="Link to heading 'Actual Behavior'" data-heading-content="Actual Behavior" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">PKCS#11 modules are <strong style="font-weight: 600; margin-top: 0px;">not</strong> initialized automatically. Applications must explicitly call <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_init()</code> or PKCS#11 operations fail silently.</p>
<h2 id="user-content-reproduction" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Reproduction<a href="#reproduction" aria-label="Link to heading 'Reproduction'" data-heading-content="Reproduction" class="anchor" style="margin-top: 0px;"></a>
</h2>
<h3 id="user-content-test-case-1-openconnect-real-world-application" dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; font-weight: 600; font-size: 1.125rem; letter-spacing: inherit; line-height: 1.25; color: #18171d;" align="initial">Test Case 1: OpenConnect (Real-World Application)<a href="#test-case-1-openconnect-real-world-application" aria-label="Link to heading 'Test Case 1: OpenConnect (Real-World Application)'" data-heading-content="Test Case 1: OpenConnect (Real-World Application)" class="anchor" style="margin-top: 0px;"></a>
</h3>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">OpenConnect calls multiple <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_*()</code> functions when processing PKCS#11 URIs, but PKCS#11 modules are never initialized.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial"><strong style="font-weight: 600; margin-top: 0px;">Command:</strong></p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang="bash" class="code highlight js-syntax-highlight language-shell" v-pre="true" style='display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="shell" style="margin-top: 0px;"><span class="nb" style="margin-top: 0px;">export </span><span class="nv">GNUTLS_DEBUG_LEVEL</span><span class="o">=</span>3</span>
<span id="LC2" class="line" lang="shell">openconnect <span class="nt" style="margin-top: 0px;">--protocol</span><span class="o">=</span>gp <span class="nt">-c</span> <span class="s2">"pkcs11:token=MyToken"</span> vpn.example.com</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial"><strong style="font-weight: 600; margin-top: 0px;">Result WITHOUT explicit <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_init()</code>:</strong></p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre class="code highlight js-syntax-highlight language-plaintext" v-pre="true" style='display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="plaintext" style="margin-top: 0px;">gnutls[2]: Enabled GnuTLS 3.8.12 logging...</span>
<span id="LC2" class="line" lang="plaintext">gnutls[2]: getrandom random generator was selected</span>
<span id="LC3" class="line" lang="plaintext">...</span>
<span id="LC4" class="line" lang="plaintext">(zero PKCS#11-related messages)</span>
<span id="LC5" class="line" lang="plaintext">...</span>
<span id="LC6" class="line" lang="plaintext">Valid client certificate is required</span>
<span id="LC7" class="line" lang="plaintext">Failed to complete authentication</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">No PKCS#11 initialization occurs, even though OpenConnect calls <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_*()</code> functions.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial"><strong style="font-weight: 600; margin-top: 0px;">Result WITH explicit <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_init()</code>:</strong></p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre class="code highlight js-syntax-highlight language-plaintext" v-pre="true" style='display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="plaintext" style="margin-top: 0px;">gnutls[2]: Enabled GnuTLS 3.8.12 logging...</span>
<span id="LC2" class="line" lang="plaintext">gnutls[2]: Initializing all PKCS #11 modules</span>
<span id="LC3" class="line" lang="plaintext">gnutls[2]: p11: Initializing module: p11-kit-trust</span>
<span id="LC4" class="line" lang="plaintext">gnutls[2]: p11: Initializing module: safesign</span>
<span id="LC5" class="line" lang="plaintext">gnutls[2]: p11: Module safesign is initialized in a thread-safe mode</span>
<span id="LC6" class="line" lang="plaintext">PIN required for MyToken</span>
<span id="LC7" class="line" lang="plaintext">Enter PIN:</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">PKCS#11 modules are loaded and authentication succeeds.</p>
<h3 id="user-content-test-case-2-minimal-reproduction-suggested" dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; font-weight: 600; font-size: 1.125rem; letter-spacing: inherit; line-height: 1.25; color: #18171d;" align="initial">Test Case 2: Minimal Reproduction (Suggested)<a href="#test-case-2-minimal-reproduction-suggested" aria-label="Link to heading 'Test Case 2: Minimal Reproduction (Suggested)'" data-heading-content="Test Case 2: Minimal Reproduction (Suggested)" class="anchor" style="margin-top: 0px;"></a>
</h3>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang="c" class="code highlight js-syntax-highlight language-c" v-pre="true" style='display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="c" style="margin-top: 0px;"><span class="cp" style="margin-top: 0px;">#include</span> <span class="cpf"><gnutls/gnutls.h></span></span>
<span id="LC2" class="line" lang="c"><span class="cp" style="margin-top: 0px;">#include</span> <span class="cpf"><gnutls/pkcs11.h></span></span>
<span id="LC3" class="line" lang="c"><span class="cp" style="margin-top: 0px;">#include</span> <span class="cpf"><stdio.h></span></span>
<span id="LC4" class="line" lang="c"></span>
<span id="LC5" class="line" lang="c"><span class="kt" style="margin-top: 0px;">int</span> <span class="nf">main</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span> <span class="p">{</span></span>
<span id="LC6" class="line" lang="c"> <span class="kt" style="margin-top: 0px;">int</span> <span class="n">ret</span><span class="p">;</span></span>
<span id="LC7" class="line" lang="c"> </span>
<span id="LC8" class="line" lang="c"> <span class="c1" style="margin-top: 0px;">// Initialize GnuTLS (but NOT PKCS#11)</span></span>
<span id="LC9" class="line" lang="c"> <span class="n" style="margin-top: 0px;">gnutls_global_init</span><span class="p">();</span></span>
<span id="LC10" class="line" lang="c"> </span>
<span id="LC11" class="line" lang="c"> <span class="c1" style="margin-top: 0px;">// Try to use PKCS#11 - should trigger auto-init according to docs</span></span>
<span id="LC12" class="line" lang="c"> <span class="n" style="margin-top: 0px;">gnutls_pkcs11_token_get_info</span><span class="p">(</span></span>
<span id="LC13" class="line" lang="c"> <span class="s" style="margin-top: 0px;">"pkcs11:token=MyToken"</span><span class="p">,</span></span>
<span id="LC14" class="line" lang="c"> <span class="n" style="margin-top: 0px;">GNUTLS_PKCS11_TOKEN_LABEL</span><span class="p">,</span></span>
<span id="LC15" class="line" lang="c"> <span class="nb" style="margin-top: 0px;">NULL</span><span class="p">,</span> <span class="nb">NULL</span></span>
<span id="LC16" class="line" lang="c"> <span class="p" style="margin-top: 0px;">);</span></span>
<span id="LC17" class="line" lang="c"> </span>
<span id="LC18" class="line" lang="c"> <span class="c1" style="margin-top: 0px;">// Check if PKCS#11 was initialized</span></span>
<span id="LC19" class="line" lang="c"> <span class="c1" style="margin-top: 0px;">// Expected: modules loaded automatically</span></span>
<span id="LC20" class="line" lang="c"> <span class="c1" style="margin-top: 0px;">// Actual: no initialization occurs</span></span>
<span id="LC21" class="line" lang="c"> </span>
<span id="LC22" class="line" lang="c"> <span class="n" style="margin-top: 0px;">gnutls_global_deinit</span><span class="p">();</span></span>
<span id="LC23" class="line" lang="c"> <span class="k" style="margin-top: 0px;">return</span> <span class="mi">0</span><span class="p">;</span></span>
<span id="LC24" class="line" lang="c"><span class="p" style="margin-top: 0px;">}</span></span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial"><strong style="font-weight: 600; margin-top: 0px;">Expected</strong>: First <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_*()</code> call triggers automatic initialization.<br>
<strong style="font-weight: 600;">Actual</strong>: No initialization occurs, PKCS#11 operations fail.</p>
<h2 id="user-content-analysis" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Analysis<a href="#analysis" aria-label="Link to heading 'Analysis'" data-heading-content="Analysis" class="anchor" style="margin-top: 0px;"></a>
</h2>
<h3 id="user-content-code-flow-in-openconnect" dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; font-weight: 600; font-size: 1.125rem; letter-spacing: inherit; line-height: 1.25; color: #18171d;" align="initial">Code Flow in OpenConnect<a href="#code-flow-in-openconnect" aria-label="Link to heading 'Code Flow in OpenConnect'" data-heading-content="Code Flow in OpenConnect" class="anchor" style="margin-top: 0px;"></a>
</h3>
<ol dir="auto" style="text-align: initial; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>openconnect_init_ssl()</code> calls <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_global_init()</code> only</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Later, certificate loading code calls various <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_*()</code> functions</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">These functions should trigger auto-initialization per documentation</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">But they don't - no PKCS#11 modules are loaded</li>
</ol>
<h3 id="user-content-which-functions-are-called" dir="auto" style="margin-top: 1.5rem; margin-bottom: 1rem; font-weight: 600; font-size: 1.125rem; letter-spacing: inherit; line-height: 1.25; color: #18171d;" align="initial">Which Functions Are Called<a href="#which-functions-are-called" aria-label="Link to heading 'Which Functions Are Called'" data-heading-content="Which Functions Are Called" class="anchor" style="margin-top: 0px;"></a>
</h3>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">OpenConnect calls (at minimum):</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_obj_*()</code> functions for certificate operations</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_privkey_*()</code> functions for private key operations</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Other PKCS#11-related GnuTLS APIs</li>
</ul>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">These should qualify as "PKCS 11 operations" that trigger auto-init.</p>
<h2 id="user-content-impact" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Impact<a href="#impact" aria-label="Link to heading 'Impact'" data-heading-content="Impact" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">This affects any application that:</p>
<ol dir="auto" style="text-align: initial; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Calls <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_global_init()</code> but not <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_init()</code>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Relies on documented automatic PKCS#11 initialization</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Uses PKCS#11 tokens for authentication</li>
</ol>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Real-world affected applications:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">OpenConnect VPN client</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Potentially other VPN clients using GnuTLS</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Any application following GnuTLS documentation</li>
</ul>
<h2 id="user-content-workaround" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Workaround<a href="#workaround" aria-label="Link to heading 'Workaround'" data-heading-content="Workaround" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Applications must explicitly call <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_pkcs11_init()</code>:</p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang="c" class="code highlight js-syntax-highlight language-c" v-pre="true" style='display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;'><code style='font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id="LC1" class="line" lang="c" style="margin-top: 0px;"><span class="kt" style="margin-top: 0px;">int</span> <span class="nf">openconnect_init_ssl</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span></span>
<span id="LC2" class="line" lang="c"><span class="p" style="margin-top: 0px;">{</span></span>
<span id="LC3" class="line" lang="c"> <span class="k" style="margin-top: 0px;">if</span> <span class="p">(</span><span class="n">gnutls_global_init</span><span class="p">())</span></span>
<span id="LC4" class="line" lang="c"> <span class="k" style="margin-top: 0px;">return</span> <span class="o">-</span><span class="n">EIO</span><span class="p">;</span></span>
<span id="LC5" class="line" lang="c"> </span>
<span id="LC6" class="line" lang="c"> <span class="c1" style="margin-top: 0px;">// Workaround for GnuTLS auto-init not working</span></span>
<span id="LC7" class="line" lang="c"> <span class="cp" style="margin-top: 0px;">#if defined(HAVE_P11KIT)</span></span>
<span id="LC8" class="line" lang="c"> <span class="k" style="margin-top: 0px;">if</span> <span class="p">(</span><span class="n">gnutls_pkcs11_init</span><span class="p">(</span><span class="n">GNUTLS_PKCS11_FLAG_AUTO</span><span class="p">,</span> <span class="nb">NULL</span><span class="p">)</span> <span class="o"><</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span></span>
<span id="LC9" class="line" lang="c"> <span class="c1" style="margin-top: 0px;">// Handle error</span></span>
<span id="LC10" class="line" lang="c"> <span class="p" style="margin-top: 0px;">}</span></span>
<span id="LC11" class="line" lang="c"> <span class="cp" style="margin-top: 0px;">#endif</span></span>
<span id="LC12" class="line" lang="c"> </span>
<span id="LC13" class="line" lang="c"> <span class="k" style="margin-top: 0px;">return</span> <span class="mi">0</span><span class="p">;</span></span>
<span id="LC14" class="line" lang="c"><span class="p" style="margin-top: 0px;">}</span></span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id="user-content-questions" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Questions<a href="#questions" aria-label="Link to heading 'Questions'" data-heading-content="Questions" class="anchor" style="margin-top: 0px;"></a>
</h2>
<ol dir="auto" style="text-align: initial; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Is automatic PKCS#11 initialization still supposed to work in GnuTLS 3.8.x?</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Which specific GnuTLS functions should trigger auto-initialization?</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Is there a specific initialization order or condition required?</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Should this be considered a regression or documentation issue?</li>
</ol>
<h2 id="user-content-references" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">References<a href="#references" aria-label="Link to heading 'References'" data-heading-content="References" class="anchor" style="margin-top: 0px;"></a>
</h2>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">GnuTLS PKCS#11 docs: <a href="https://gnutls.org/manual/html_node/PKCS11-Initialization.html" rel="nofollow noreferrer noopener" target="_blank" style="margin-top: 0px;">https://gnutls.org/manual/html_node/PKCS11-Initialization.html</a>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">OpenConnect issue <a href="https://gitlab.com/gnutls/gnutls/-/issues/835" title="nettle 3.5 issues/warnings" class="gfm gfm-issue" data-original="#835" data-link="false" data-link-reference="false" data-issue="24788150" data-project="179611" data-iid="835" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">#835 (closed)</a>: <a href="https://gitlab.com/openconnect/openconnect/-/issues/835" title="PKCS#11 modules not initialized when using GnuTLS backend with certificate authentication Description:" class="gfm gfm-issue" data-original="https://gitlab.com/openconnect/openconnect/-/issues/835" data-link="false" data-link-reference="true" data-issue="184038675" data-project="2335175" data-iid="835" data-namespace-path="openconnect/openconnect" data-project-path="openconnect/openconnect" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue">openconnect/openconnect#835</a>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">RFC 7512 (PKCS#11 URI): <a href="https://tools.ietf.org/html/rfc7512" rel="nofollow noreferrer noopener" target="_blank" style="margin-top: 0px;">https://tools.ietf.org/html/rfc7512</a>
</li>
</ul>
<h2 id="user-content-related-issues" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Related Issues<a href="#related-issues" aria-label="Link to heading 'Related Issues'" data-heading-content="Related Issues" class="anchor" style="margin-top: 0px;"></a>
</h2>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<p style="color: #3a383f; margin: 0px 0px 1rem;"><strong style="font-weight: 600; margin-top: 0px;">GnuTLS <a href="https://gitlab.com/gnutls/gnutls/-/issues/1784" title="SafeSign IC 3.8.0.0 PKCS#11 module and GnuTLS incompatible" class="gfm gfm-issue" data-original="#1784" data-link="false" data-link-reference="false" data-issue="181248780" data-project="179611" data-iid="1784" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">#1784 (closed)</a></strong> - "SafeSign token compatibility: CKR_ARGUMENTS_BAD with threading flags" (January 2026)</p>
<ul style="list-style-type: circle; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">URL: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1784" title="SafeSign IC 3.8.0.0 PKCS#11 module and GnuTLS incompatible" class="gfm gfm-issue" data-original="https://gitlab.com/gnutls/gnutls/-/issues/1784" data-link="false" data-link-reference="true" data-issue="181248780" data-project="179611" data-iid="1784" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">#1784 (closed)</a>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Our previous report about SafeSign driver rejecting PKCS#11 threading flags</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Patch submitted to add fallback for <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>CKR_ARGUMENTS_BAD</code> with <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>flags=0</code>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">This current issue is different but related: auto-initialization not working</li>
</ul>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">
<p style="color: #3a383f; margin: 0px 0px 1rem;"><strong style="font-weight: 600; margin-top: 0px;">GnuTLS <a href="https://gitlab.com/gnutls/gnutls/-/issues/1060" title="Uninitialized lock when using pkcs11 private key for signing" class="gfm gfm-issue" data-original="#1060" data-link="false" data-link-reference="false" data-issue="69526032" data-project="179611" data-iid="1060" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">#1060 (closed)</a></strong> - "Uninitialized lock when using pkcs11 private key for signing" (August 2020)</p>
<ul style="list-style-type: circle; margin: 0px 0px 1rem; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">URL: <a href="https://gitlab.com/gnutls/gnutls/-/issues/1060" title="Uninitialized lock when using pkcs11 private key for signing" class="gfm gfm-issue" data-original="https://gitlab.com/gnutls/gnutls/-/issues/1060" data-link="false" data-link-reference="true" data-issue="69526032" data-project="179611" data-iid="1060" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">#1060 (closed)</a>
</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Similar symptom: "Thread locking error" in single-threaded application</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Context: Lock not initialized when using PKCS#11 private key</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">May be related to PKCS#11 initialization issues</li>
</ul>
</li>
</ul>
<h2 id="user-content-additional-information" dir="auto" style="margin-top: 20px; margin-bottom: 10px;" align="initial">Additional Information<a href="#additional-information" aria-label="Link to heading 'Additional Information'" data-heading-content="Additional Information" class="anchor" style="margin-top: 0px;"></a>
</h2>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">I can provide:</p>
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0px; padding: 0;">
<li style="margin-top: 0px; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Complete debug logs (with <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 0.125rem 0.25rem;'>GNUTLS_DEBUG_LEVEL=9</code>)</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Minimal test case if needed</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">Testing on different GnuTLS versions</li>
<li style="line-height: 1.6em; margin-left: 25px; padding-left: 3px;">p11-kit configuration details</li>
</ul>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/issues/1798">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/3-6fael9skc9dpucrixg3jt7bek/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/issues/1798 at 1771088918
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Issue","url":"https://gitlab.com/gnutls/gnutls/-/issues/1798"}}</script>
</p>
</div>
</body>
</html>