title: SunPKCS11 provider in Java 9
body: <p>Up to Java 8 the SunPKCS11 provider was loaded like this:</p>
  
  <pre><code>Provider provider = new sun.security.pkcs11.SunPKCS11 (new ByteArrayInputStream (configFile.getBytes ()));
  Security.addProvider (provider);
  </code></pre>
  
  <p><code>configFile</code> is a String with the configuration parameters. So, if the application needed to work with several connected smart cards it could create multiple providers. To access each provider the name used was "SunPKCS11-" followed by the name we indicated in the configuration.</p>
  
  <p>In Java 8, the <code>sun.security.pkcs11.SunPKCS11</code> class was removed in the JDK. So, I had to program the previous call by reflection.</p>
  
  <p>The operation of the PKCS#11 provider in Java 9 seems very different:</p>
  
  <ul>
  <li><p>The <code>SunPKCS11</code> constructor has been changed to an empty one. The configuration is loaded by the "configure" method, so it is mandatory that it is in a file on disk and I can no longer load it through a stream to a string.</p></li>
  <li><p>If we try to use the reflection the following warnings appear:</p></li>
  </ul>
  
  <blockquote>
  <pre><code>WARNING: An illegal reflective access operation has occurred
  WARNING: Illegal reflective access by PruebaTarjeta (file:/C:/temp/pkcs11java9/classes/) to constructor
  sun.security.pkcs11.SunPKCS11()
  WARNING: Please consider reporting this to the maintainers of PruebaTarjeta
  WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
  WARNING: All illegal access operations will be denied in a future release
  </code></pre>
  </blockquote>
  
  <ul>
  <li>In Java 9, a SunPKCS11 provider is automatically generated and is in the list of cryptographic providers. It can be obtained from the list and configured. The problem is that you can only have one PKCS#11 provider loaded in the list. The <a href="https://docs.oracle.com/javase/9/security/pkcs11-reference-guide1.htm#JSSEC-GUID-C4ABFACB-B2C9-4E71-A313-79F881488BB9" rel="noreferrer">Java 9 documentation</a> indicates that we can get the PKCS#11 provider with "SunPKCS11-" followed by the name we indicated in the configuration, but it's not true. If we look at the list of providers the only one is "SunPKCS11" so I can not have one provider per smart card.</li>
  </ul>
  
  <p>Do this also happen to someone else? Any solution?</p>