XMLSEC Sign 45:key is not found error - pem file exists and validated with openssl

[IntoTheWebNet]

Try to sign an xml with sha256-rsa-MGF1 / sha256 with rsa private key and corresponding certificate.

Whats the root cause for the error?

using actual version
[xmlsec1-1.3.4-win64.zip] (https://www.aleksey.com/xmlsec/download/win64/xmlsec1-1.3.4-win64.zip) 9-Apr-2024 14:54

all files stored in same folder. The xmlsec.exe, all dlls, pem and xml

cert20240405.pem
key20240405.pem
keypub20240405.pem
xml-unsigned.xml

libcrypto-3-x64.dll
libexslt.dll
libssl-3-x64.dll
libxml2.dll
libxmlsec-mscng.dll
libxmlsec-mscng.pdb
libxmlsec-openssl.dll
libxmlsec-openssl.pdb
libxmlsec.dll
libxmlsec.pdb
libxslt.dll
openssl.exe
xmlsec.exe
xsltproc.exe

xml trying to sign

<?xml version="1.0" encoding="UTF-8"?>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
	<ds:SignedInfo>
		<ds:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
		<ds:SignatureMethod Algorithm="http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1"/>
		<ds:Reference URI="#object">
			<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
			<ds:DigestValue>
			</ds:DigestValue>
		</ds:Reference>
	</ds:SignedInfo>
	<ds:SignatureValue>
	</ds:SignatureValue>
	<ds:KeyInfo>
		<ds:X509Data>
			<ds:X509SubjectName>
			</ds:X509SubjectName>
			<ds:X509Certificate>
			</ds:X509Certificate>
		</ds:X509Data>
	</ds:KeyInfo>
	<ds:Object Id="object">
		<dip/>
	</ds:Object>
</ds:Signature>

try to sign xml

xmlsec.exe sign --crypto openssl --privkey-pem key20240405.pem,cert20240405.pem --output xml-signed.xml --verbose --print-debug xml-unsigned.xml
func=xmlSecKeysMngrGetKey:file=..\src\keys.c:line=1346:obj=unknown:subj=unknown:error=45:key is not found:details=NULL
func=xmlSecDSigCtxProcessKeyInfoNode:file=..\src\xmldsig.c:line=822:obj=unknown:subj=unknown:error=45:key is not found:details=NULL
func=xmlSecDSigCtxProcessSignatureNode:file=..\src\xmldsig.c:line=537:obj=unknown:subj=xmlSecDSigCtxProcessKeyInfoNode:error=1:xmlsec library function failed:
func=xmlSecDSigCtxSign:file=..\src\xmldsig.c:line=301:obj=unknown:subj=xmlSecDSigCtxProcessSignatureNode:error=1:xmlsec library function failed:
Signature status: FAILED
Failure reason: KEY-NOT-FOUND
= SIGNATURE CONTEXT
== Status: FAILED
== Failure reason: KEY-NOT-FOUND
== flags: 0x00000000
== flags2: 0x00000000
== Key Info Read Ctx:
= KEY INFO READ CONTEXT
== flags: 0x00000000
== flags2: 0x00000000
== enabled key data: all
== RetrievalMethod level (cur/max): 0/1
== TRANSFORMS CTX (status=0)
== flags: 0x00000000
== flags2: 0x00000000
== enabled transforms: all
=== uri: NULL
=== uri xpointer expr: NULL
== KeyInfoReference level (cur/max): 0/1
== TRANSFORMS CTX (status=0)
== flags: 0x00000000
== flags2: 0x00000000
== enabled transforms: all
=== uri: NULL
=== uri xpointer expr: NULL
== EncryptedKey level (cur/max): 0/1
=== KeyReq:
==== keyId: rsa
==== keyType: 0x00000002
==== keyUsage: 0x00000001
==== keyBitsSize: 0
=== list size: 0
== Key Info Write Ctx:
= KEY INFO WRITE CONTEXT
== flags: 0x00000000
== flags2: 0x00000000
== enabled key data: all
== RetrievalMethod level (cur/max): 0/1
== TRANSFORMS CTX (status=0)
== flags: 0x00000000
== flags2: 0x00000000
== enabled transforms: all
=== uri: NULL
=== uri xpointer expr: NULL
== KeyInfoReference level (cur/max): 0/1
== TRANSFORMS CTX (status=0)
== flags: 0x00000000
== flags2: 0x00000000
== enabled transforms: all
=== uri: NULL
=== uri xpointer expr: NULL
== EncryptedKey level (cur/max): 0/1
=== KeyReq:
==== keyId: NULL
==== keyType: 0x00000001
==== keyUsage: 0xffffffff
==== keyBitsSize: 0
=== list size: 0
== Signature Transform Ctx:
== TRANSFORMS CTX (status=0)
== flags: 0x00000000
== flags2: 0x00000000
== enabled transforms: all
=== uri: NULL
=== uri xpointer expr: NULL
=== Transform: c14n (href=http://www.w3.org/TR/2001/REC-xml-c14n-20010315)
=== Transform: rsa-pss-sha256 (href=http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1)
== Signature Method:
=== Transform: rsa-pss-sha256 (href=http://www.w3.org/2007/05/xmldsig-more#sha256-rsa-MGF1)
== SignedInfo References List:
=== list size: 0
== Manifest References List:
=== list size: 0
Error: failed to sign file "xml-unsigned.xml"

test private key stored in pem file with openssl

openssl.exe rsa -check -in key20240405.pem -noout
RSA key ok

check certificate stored in pem file with openssl

openssl x509 -in cert20240405.pem -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2e:55:25:e5:28:de:0d:ed:59:66:5a:ce:57:57:b2:be:e6:52:74:eb
        Signature Algorithm: rsassaPss
        Hash Algorithm: sha256
        Mask Algorithm: mgf1 with sha256
         Salt Length: 0x20
        Trailer Field: 0x01 (default)
        Issuer: C = DE, ST = ..., L = ..., O = ..., CN = ..., emailAddress = ...
        Validity
            Not Before: Apr  5 11:53:00 2024 GMT
            Not After : Apr  3 11:53:00 2034 GMT
        Subject: C = DE, ST = ..., L = ..., O = ..., CN = ..., emailAddress = ...
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
...
    Signature Algorithm: rsassaPss
    Signature Value:
        Hash Algorithm: sha256
        Mask Algorithm: mgf1 with sha256
         Salt Length: 0x20
        Trailer Field: 0x01 (default)
...

[lsh123]

Please check section 3.5 from the faq:

https://www.aleksey.com/xmlsec/faq.html

(tldr; you probably should add <ds:KeyName>my-key</ds:KeyName> node to<ds:KeyInfo/> node and also specify the same key name in the command line ... --privkey-pem:my-key key20240405.pem,cert20240405.pem ...)